Google's Plan To Kill the Corporate Network

mask.of.sanity writes "Google has revealed details on its Beyond Corp project to scrap the notion of a corporate network and move to a zero-trust model. The company perhaps unsurprisingly considers the traditional notion of perimeter defense and its respective gadgetry as a dead duck, and has moved to authenticate and authorize its 42,000 staff so they can access Google HQ from anywhere (video). Google also revealed it was perhaps the biggest Apple shop in the world, with 43,000 devices deployed and staff only allowed to use Windows with a supporting business case."

Comments

Wow

[MightyMartian]

Wow, Google has invented the VPN! What great innovators.

Re:Wow

[binarylarry]

"Firewalls don't help"

LOL! You could make the case that Firewalls aren't perfect security solutions but god damn.

Re:Wow

[Anonymous Coward]

Their datacenters got owned by the NSA. Why would anyone trust them on security?

Re:Wow

[Anonymous Coward]

Wow, Google has invented the VPN! What great innovators.

I think they discovered IPSec, which actually has little to do with VPN as most people use it. VPN is just a special case of IPSec in tunnel mode, which I think is quite crappy mode of communication, only needed because lack of IPSec deployment and lack of address space (ehem, IPv6).

This is actually quite old in Microsoft realm. MSDN has documentation of setting up domain (ie. active directory definition) with IPSec ACLs going back over a decade. It is just not used because it was deemed "difficult to use" and such and no one bothered. (that's aside of microsoft IPSec stack that cannot be audited by 3rd parties)

Re:Wow

[fnj]

Their ASSES got owned by the NSA. Why would anyone think they CARE about security?

Re:Wow

[russotto]

No, a VPN still depends on a perimeter defense; the VPN is an tunnel through the perimeter and once the tunnel is set up, you have full access.

Re:Wow

[Anonymous Coward]

What they're saying is that the idea of border security is a bad model. One compromised system on the inside and you're pretty much done. IDS and DPI are good ideas but they aren't effective enough. Breaking in to any corporate network is as easy as spamming it's users with social-engineering-laden email. Get them to click on a link and you own their soft, squishy, zero-day-vulnerable desktops. Keylog and steal their credentials and you've got a jumping off point to worm in to the rest of their network. It's that easy.

What they're saying is once you move to a trust-nothing model.. Why bother investing in a huge corp network when you can't trust it anyway? When you don't have big corp network what's, the advantages of running your own services over purchasing them from someone else? Like Google?

Re:Wow

[Anonymous Coward]

You can still limit tunneled in clients so that they have to know where they are going, such as authenticating through a previously known RADIUS in order to traverse the network via VPN.

Re:Wow

[Chas]

Because we're dealing with zero trust.

That ALSO means I don't necessarily trust a 3rd party host either.

Re:Wow

[SuricouRaven]

"Why bother investing in a huge corp network when you can't trust it anyway?"

Redundency in security.

Re:Wow

[binarylarry]

But it's not a bad idea, it's just dumb to rely solely on it.

I can just imagine the military "Fuck the perimeter, if the enemy gets inside the base it's going to be all knives and hand to hand combat anyway. Sell the guns boys, we're all getting HUGE KNIVES!"

Re:Wow

[Anonymous Coward]

So did yours. But theirs has a higher uptime and a nice SLA.

Re:Wow

[icebike]

"Why bother investing in a huge corp network when you can't trust it anyway?"

Redundency in security.

And its in-hand. You can fix it, expand it, modernize it, control it, instead of shifting all that responsibility to some third party to which you are merely another customer.

Trusting nothing, protection at machine level, the user level, the application level and the data level will not do away with the corporate networks.
If anything, it may have the opposite effect, and encourage more use of such wholly-owned networks, perhaps melded with some cloud services.

But as sooner we move away from the Maginot Line mentality for our networks the better.

It may seem counter intuitive in the physical world, but a point defense system is easier to implement in computer networks than in the real world. Each computer should protect itself. Build this in from the beginning and it just happens naturally each computer, each file, each application. Because relying on the stockade to keep out the attackers hasn't actually worked that well in the physical world, and costs a boatload of money and expertise in the network world.

What good is ipv6 if we all have to hide behind firewalls forever.?

Re:Wow

[WaffleMonster]

I can just imagine the military "Fuck the perimeter, if the enemy gets inside the base it's going to be all knives and hand to hand combat anyway. Sell the guns boys, we're all getting HUGE KNIVES!"

RL military analogies often map poorly to network security space yet it rarely prevents people from making them anyway.

Re:Wow

[Charliemopps]

As the senior admin for such an outsourced network, I can tell you what will happen about 2 to 3 years after you migrate to an outsourced service like this.

"We're deprecating the ODBC connection as of January 1... no worries we've got a great new API and it accepts SQL!"
"To reduce system load and improve overall performance of your system we're limiting SQL requests to 100k rows"
"To enhance SLQ efficiency we've written our own proprietary query language called FU-SQL it's fantastic"
"We're aware that some of our customers are not happy with speed of FU-SQL so we've limited the number of joins you can make in a select statement to 1"
"To reduce costs for our customers we now bill our FU-SQL module separately, if you don't use it you don't have to pay for it! If you would like the unneeded additional FU-SQL feature it will bill for $150k/year"
"due to lack of interest FU-SQL has been discontinued, if you need mass access to your data please contact our professional service"

At this point they start doubling the price of their service every time you sign a new contract. Then your boss will ask you why your quote for migrating the network somewhere else was "A Metric Shitton of money"

Have fun with your outsourced network!

Re:Wow

[icebike]

I don't think you can compare it to a physical situation.

If you had secure operating systems, and encrypted data flows, and weren't listening on a bazillion ports, it would be just as easy to secure the network by securing individual computers as it would to secure the perimeter.

The problem is security is a bolted on afterthought for some operating systems (Windows), printers, storage devices, and software applications.
If we could get past that, we could stop building walls.

Re:Wow

[steelfood]

I'm no expert in the field, but my understanding is that there are several models of network security based on real-world notions of security.

VPN is a part of your traditional wall security, where your typical authentication and authorization happens at each level of security zone. Once you're in, you can do anything the zone permits you to do. VPN is, as stated by others, placed at the perimeter.

BTW, full internal company-wide encryption just means putting the secure zones under a roof so no one flying overhead can see what's going on from above (e.g. big brother).

Another model of security relies on negative feedback. There are no locks anywhere, and no one has keys, but missteps have consequences. That's the security model most modern governments employ against their citizens. The levels of surveillance, strictness of the deeds, and harshness of the punishment determine the repressiveness of the model. The level of security is proportional to the amount of monitoring (a place like prison being maximum security).

There are other models, I'm certain, but like I said, I'm no expert. These are the two more prevalent ones out there right now.

Zero trust is completely different. It's almost like a double-blind experiment. There's no trust anywhere. Not the users/developers, not the administrators, not the auditors, not anyone. Authentication is fundamentally a trust-building mechanism, and a zero-trust model means authentication is obsolete (remember, encryption is merely erecting a roof over everything). Anyone can get in and do all the same things. The only difference is in the domain knowledge of the actors, which differenciates those able to do more things from less things if anything at all.

A rather dirty analogy of zero trust would be hosting an open project on Github. Anyone can go in and make modifications, but only those who know the code could make modifications that do meaningful work. And then, of the people building the code and running it, only those who who possess the ability to verify the modifications would know that they're not harmful specifically for their use cases.

Another analogy of zero trust would be to have an open e-mail account. There's no guarantees the sender is represented by the name. Every e-mail is assumed to have been read by anyone capable of entering the system. (Changing or deleting e-mails can be universally prohibited.) Such an account would be mostly useful for communications of metadata information, i.e. where and when to meet, and trivial matters.

I don't think Google's gone quite that far with their security model. They may have gotten rid of the VPN (or not...), but there are still SSH keys used for authentication and authorization, and users still need to log in to their machine to use it. After all, zero trust implies that even we the ultimate end users can't trust what's coming out of Google to be accurate (assuming that we could before--that's another debate for another time). And I don't think Google wants to make that impression.

It may be that they started with a zero-trust model, and identified the areas where trust is unnecessary, which they left insecure. At the same time, they also identified where trust is absolutely necessary, as well as the level of trust that's appropriate, and put up the necessary strength of walls to secure them, as well as levels of monitoring to see who's entering different zones. That sounds far more reasonable to me, especially considering the amount of trade and other secrets Google is holding onto.

Re:Wow

[Jack Griffin]

What good is IPv6 at all? I'm working on a application whitelisting project at the moment, that is at tight as security gets for each individual machine. It is a hugely expensive complicated nightmare, so while it may tick a lot of theoretical security boxes, it is simply impractical for most networks. 'Good enough' has gotten mankind by for Millenia, what makes you think that will change now?

Re:Wow

[ancientt]

And not just "know where they are going," you can limit them to target=yourAccessTarget from the perimeter so they are limited at least in the first hop.

Re:Wow

[aaarrrgggh]

Depends on the type of vpn. Plenty of systems that allow very granular access to specific applications or resources.

Re: Wow

[Anonymous Coward]

Wasn't that the plot of pacific rim?

Re: Wow

[Anonymous Coward]

Where did we lose control, when it all started so simply: a 1 is not a 0.

Re:Wow

[Anonymous Coward]

As the senior admin for such an outsourced network, I can tell you what will happen about 2 to 3 years after you migrate to an outsourced service like this.

"We're deprecating the ODBC connection as of January 1... no worries we've got a great new API and it accepts SQL!"
"To reduce system load and improve overall performance of your system we're limiting SQL requests to 100k rows"
"To enhance SLQ efficiency we've written our own proprietary query language called FU-SQL it's fantastic"
"We're aware that some of our customers are not happy with speed of FU-SQL so we've limited the number of joins you can make in a select statement to 1"
"To reduce costs for our customers we now bill our FU-SQL module separately, if you don't use it you don't have to pay for it! If you would like the unneeded additional FU-SQL feature it will bill for $150k/year"
"due to lack of interest FU-SQL has been discontinued, if you need mass access to your data please contact our professional service"

At this point they start doubling the price of their service every time you sign a new contract. Then your boss will ask you why your quote for migrating the network somewhere else was "A Metric Shitton of money"

Have fun with your outsourced network!

Charliemopps speaketh the divine truth.

Re:Wow

[SuricouRaven]

It's good for not making Skype, p2p programs, online games, FTP and IM file transfers break when ISPs are left with no option but to turn to carrier-level PAT to keep their networks functional.

Re:Wow

[Anonymous Coward]

the VPN is an tunnel through the perimeter and once the tunnel is set up, you have full access.

Not at all. Once I'm in our corporate network I can access a few general Intranet sites.

All other access is based upon being granted access to security groups, which then grant routing to certain project-related clusters. Access to those is two-factor.

I can't even *route* to production servers, that's reserved for the deployment team.

Re:Wow

[Anonymous Coward]

Yes, it's a bait-and-switch with loss-leader prices to get you to sign up and move to the outsourced network, then the screw starts turning as they add more and more costs if you want to do anything beyond bare bones. I was actually happy to be fired as a systems programmer when my company did the switch, so I wouldn't have to deal with them. The problem is the consultants selling the outsourced network get the ear of some manager, who gets a bonus for reducing costs, and then leaves the company before the consequences can catch up to him, leaving someone else to fix the mess.

Re:Wow

[Anonymous Coward]

Then your boss will ask you why your quote for migrating the network somewhere else was "A Metric Shitton of money... Have fun with your outsourced network!

Sounds like IBM

Re: Wow

[locke.th]

Awesome. If I could mod this up, I would.

Re:Wow

[markhb]

It's good for not making Skype, p2p programs, online games, FTP and IM file transfers break

Making those break sounds like a decent raison d'etre for a corporate network in the first place.

Re:Wow

[Anonymous Coward]

What they are also saying is that they want to use the resources in the user's devices much more.

Re:Wow

[Anonymous Coward]

Everyone's asses got owned by the NSA, and I give Google and some of the other big boys credit for wanting to do something about it. Encrypting their datacenter communications was a good first step.

eh, Google no eat own dogfood?

[Spy Handler]

why use so many Apple computers when there's your own awesome Chromebook?

Re:eh, Google no eat own dogfood?

[plover]

My dog eats its own poop.

Not a ringing endorsement for the dog food metaphor.

Re:eh, Google no eat own dogfood?

[aaronjp]

Perhaps, because it is still primarily a content consumption device and not a content creation device.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

Not even google is dumb enough to try to use a chromebook to be productive!

Re:eh, Google no eat own dogfood?

[BreakBad]

Charlie don't surf.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

So in other words Google LIED about what the chromebook is as they have been pushing it as a business tool ideal for collaboration and productivity work.

Re:eh, Google no eat own dogfood?

[luis_a_espinal]

Perhaps, because it is still primarily a content consumption device and not a content creation device.

This. Content consumption =/= content creation. Sadly, the nuisance is missed to many in this supposedly nerd realm that slashdot is supposed to be.

Re:eh, Google no eat own dogfood?

[djdanlib]

Chromebooks aren't exactly fast or high-res. Unless you buy the Pixel, but then you might as well buy a real laptop. I wouldn't stick an employee with a slow half-top and expect them to be productive.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

google have been pushing the chromebooks as ideal PC replacements for workers in business, Just look at there own chromebook pages. I agree that chromebooks are crap for productivity, BUT that is certainly not what they are telling other businesses.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

Perhaps, because it is still primarily a content consumption device and not a content creation device.

This. Content consumption =/= content creation. Sadly, the nuisance is missed to many in this supposedly nerd realm that slashdot is supposed to be.

Nuance. Not nuisance. Though I cannot begin to tell you how that mistake makes this discussion far more hilarious.

Re:eh, Google no eat own dogfood?

[atom1c]

Charlie don't surf.

YES!

Re:eh, Google no eat own dogfood?

[Samantha Wright]

I can! It makes it completely. Completely of the hilarious.

Re:eh, Google no eat own dogfood?

[gstoddart]

This. Content consumption =/= content creation. Sadly, the nuisance is missed to many in this supposedly nerd realm that slashdot is supposed to be.

First all, it's 'nuance'. (Though, an argument could be made for nuisance too)

But, the reality is, the overwhelming majority of non-nerds using the interwebs are purely doing content consumption, and that's all they ever will do. And, even as a nerd, a huge fraction of what I do outside of work is perfectly fine on a tablet.

Which means the overwhelming majority of people do not require or perform content creation, and those devices do exactly what they need them to.

Something else this supposedly nerdy realm fails to grasp. Just because we can't use it to build new things doesn't mean the people buying them will ever feel limited. In fact, most of them would roll their eyes at us.

My mother in law does 95% (or more) of everything she will ever need a computer for on her Nexus 7 tablet. For most people, that's all they'll ever need.

Re:eh, Google no eat own dogfood?

[gstoddart]

I wouldn't stick an employee with a slow half-top and expect them to be productive.

In my experience, a lot of companies buy whatever they can get a bulk price on and which someone in purchasing deems "good enough".

Resulting in employees with slow machines on which they're expected to be productive.

Hell, at an old job they bought a crap-load of new Dell boxes, and the native aspect ratio of the monitor was a non-standard thing in which a circle was drawn as an oval because the monitor was optimized for watching movies at 720p, but not for actually being a monitor (it's native aspect ratio was oblong pixels). Oh, and the machines came with 4GB of RAM, the OS they came with could only see 3GB of RAM, and it wasn't possible to install a newer OS on it because there were no drivers available.

In short, never underestimate how crappy of a machine companies will buy for their employees if it saves them a few bucks. Because many of them do it all the time.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

It is a content creation device, content google get's to datamine and sell to other firms.

Re:eh, Google no eat own dogfood?

[jythie]

But.. but.. if it isn't good for everything including our l33t development/gamer/photoshop requirements it can't be good for anything!

Re:eh, Google no eat own dogfood?

[gtall]

Sadly, missing the nuance of the English language a nuisance as well.

Re:eh, Google no eat own dogfood?

[stenvar]

Because Google is an engineering company. Chrome books are for home users and light business users. They are also fairly new.

I expect Google to do more development in the browser and eventually dump Apple.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

So in other words Google LIED about what the chromebook is as they have been pushing it as a business tool ideal for collaboration and productivity work.

With the rise of cloud services (formerly known as hosted application services) there is a diminishing need to have software installed on each computer, be it desktop or notebook or tablet or smartphone) these days. Even software developers can remotely access terminal sessions or a GUI VDI session to access the development toolchain and source code repositories. The most significant drawback is the potential disruption in productivity if the ISP or wireless carrier providing connectivity has an outage or degraded service level.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

Using apple computers could also be why they are advocating the 'beyond work' anywhere computer. Apple does not have a very good AD strategy. MS has that locked tight in how well you can lock down a computer. AD is also very good at helping test/push for patches. You can get solutions like that in apple computers. But it takes a decent bit of work.

Apple is basically a BSD/Unix style computer where all computers are peers there is no concept of 'client server'. As everyone is a server and a client. Chromebooks are more like thin clients where they are not peers but consumers of data. MS computers can be both (it takes AD to pull it off in a large deployment).

It is why Apple has hit a wall in some orgs. Some orgs out there love the control (work *snap* work HARDER *snap*).

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

google have been pushing the chromebooks as ideal PC replacements for workers in business, Just look at there own chromebook pages. I agree that chromebooks are crap for productivity, BUT that is certainly not what they are telling other businesses.

It depends on the particular use case. For many organizations including schools the Google Chromebook makes sense. Although the mandatory requirement of a Google account which effectively tracks everything you do is troublesome. However, for a non-insignificant portion of the home market Google Chromebooks are the ideal solution to worry-free web browsing, instant messaging, social networking, and email.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

that significant drawback of network connectivity isn't just significant. It is devastating and the vast majority of businesses cannot be at the whim of ISP's, cloud hosting providers or local telecoms just to be able to do basic business tasks. Many businesses suffer immensely just from having mail down. Take away their ability to do local work stuff as well when the network hiccups and you have a recipe to send many companies to the wall with just a few small outages.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

Completely of the hilarious.

What?!?

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

My company's email servers go down much more frequently than my home network does. And that goes down much more frequently than gmail does. So ... I don't think you're making an argument for what you think you're making an argument for.

Re:eh, Google no eat own dogfood?

[harvestsun]

Uh, because a Chromebook isn't (and isn't intended to be) a general purpose computer? You might as well be asking "why do Apple employees not do their work on iPod Touches?"

Re:eh, Google no eat own dogfood?

[CTachyon]

why use so many Apple computers when there's your own awesome Chromebook?

Google employee here (but I don't speak for my employer and I am basing this purely on anecdotal observation, not hard data).

I'm only familiar with my impressions from the engineering side, so I don't know much about the sales and marketing side of things, but nearly all of the engineers use Linux desktops (unless they're developing client software, like Chrome). Laptops are a different story. As a Bay Area-wide phenomenon, software engineers sure like their Macbooks, and this place is no exception. A few of us run Linux laptops, but my impression is that Macbooks outnumber Linux laptops plus Chromebooks combined. But the internal hardware requisition site is now offering the Pixel (indeed, recommending it instead of Macbooks), so this should change with time.

There's also the matter of hardware refresh cycles. The Pixel is not even a year old yet, and it hasn't been available for requisitions for its entire lifespan, so a good number of employees haven't yet had the chance to switch even if they want to. (Returned working laptops are refurbished and reused, so turning over the inventory will take longer than you might expect.) Also, lack of VPN or native SSH impeded the Chromebook's internal usefulness in the early days, but today hardly anything still requires VPN (it works now regardless) and the Secure Shell app is pretty workable (set it "Open as Window" so that ^W goes to the terminal). And... well, the early Chromebooks had anemic hardware specs, which is not true of the Pixel.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

if you are hosting your desktops out in the cloud you are not only reliant on google to be stable, you are reliant on your local network and telecoms, reliant on your local ISP and reliant on any connections from your ISP to google. these will fail, many businesses when mail goes down can still work as they have plenty of local tools, if you took away there desktops completely there are a lot of companies that could literally go broke in a very short space of time in this scenario, it is a stupid situation to put your business in if you have any sort of real need for desktop apps.

Re:eh, Google no eat own dogfood?

[Sir_Eptishous]

Mod Points!

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

And the result of ALL of those single points of failure is still, combined, MORE reliable than my large companies Email servers.

If a large multi-billion dollar company can't run an email server better than google's consumer-oriented products over the consumer-grade internet connection via the consumer-grade chromebook/cell phone.... why should a small company conclude that they can?

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

Apple does have a directory system and management tools, Ars Technica has a 10 page review up today in fact.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

Maybe this is their first slip up that shows us Apple created Google to directly engineer price wars?

Re:eh, Google no eat own dogfood?

[PaddyM]

Instead of ZeroTrust, ZeroWing. Only belief those who speak Engrish.

Re:eh, Google no eat own dogfood?

[_merlin]

The vast majority of non-nerds need a PC at work to perform their job function. Often it ultimately boils down to data entry or inventory control. It's neither content consumption nor content creation - these labels only really apply to specific industries.

Re:eh, Google no eat own dogfood?

[bledri]

why use so many Apple computers when there's your own awesome Chromebook?

Because the Chromebook is basically a web-browser wrapped in hardware. You wouldn't want to compile code or run VMs on it. That doesn't mean the Chromebook is useless.

Re:eh, Google no eat own dogfood?

[gitano_dbs]

ZeroCool

Re:eh, Google no eat own dogfood?

[Bill, Shooter of Bul]

Care to share the Distro of choice on those linux based non chromebook machines? Is it a free employee option ? Are there a set number of pre-approved distros? Is there a top-secret Google Gnu-Linux Distro that dispenses chocolates on the half hour?

Re:eh, Google no eat own dogfood?

[thetoadwarrior]

Except google expects others to do that. http://www.google.co.uk/intl/en/chrome/business/devices/

Re:eh, Google no eat own dogfood?

[WaffleMonster]

Because Google is an engineering company.

Google is an advertising company.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

Google engineer here: I have a Pixel and I love it. I'm perfectly productive doing cloud-based development on it. Screen is gorgeous, keyboard is fine. Two-second boot and resume is great. If the hardware fails, you get a new one, log in, and are back in business within a couple of minutes, not hours. Much less screwing around than on an Ubuntu or Debian-based desktop I've had, to say nothing of laptops.

I couldn't do without a linux box to ssh to, but I see no good reason to carry it around with me.

Re:eh, Google no eat own dogfood?

[russotto]

Care to share the Distro of choice on those linux based non chromebook machines? Is it a free employee option ? Are there a set number of pre-approved distros? Is there a top-secret Google Gnu-Linux Distro that dispenses chocolates on the half hour?

The last, only it's healthy-organic-snack-of-the-week rather than chocolates. Seriously, it's a Google-specific distribution called Goobuntu.

Re:eh, Google no eat own dogfood?

[farble1670]

if you are adding or modifying data, that's content creation, even it's as boring as updating cells in a spreadsheet.

Re:eh, Google no eat own dogfood?

[Bill, Shooter of Bul]

Dark chocolate is kind of healthy, and can be organic as well as fairly traded.

I'd suggust the following replacement:

http://www.wholefoodsmarket.com/products/whole-foods-market-organic-dark-chocolate-bar-tanzania-schoolhouse-project

I mean its for kids! In Africa! How better to not be evil, than by activily doing not evil?

Re:eh, Google no eat own dogfood?

[Cramer]

I think that's a ringing endorsement for not using Microsoft Exchange, plus however many 3rd party add-ons and "business process integration" crap corporations always bolt-on to it. Exchange on it's own is fairly reliable -- as long as you aren't constantly poking at it. (even more so if you don't let the internet talk to it.) But there are, indeed, significantly more stable email platforms than Exchange.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

http://en.wikipedia.org/wiki/Goobuntu

You only get one distro option, but you can in general install anything in the standard repository (so you can turn it into, say, GKubuntu, which is what I do).

Re:eh, Google no eat own dogfood?

[juosukai]

Apple does have a directory system and management tools, Ars Technica has a 10 page review up today in fact.

Nobody in their right mind tries using Mac OS X server to manage any real amount of macs (not by itself, anyways). Otherwise you are correct, mac can be perfectly good corporate citizens, with every aspect of the client locked down and managed centrally. You can use commercial 3rd party software to do it (Casper, Absolute Manage) or do it with Open Source tools (Puppet, Munki). You can use Apple Profile Manager combined with any of tools above. You can even use SCCM with Macs these days (if you really, really want to), or product like Centrify, to attach your mac to your AD with better control.

If you really are interested in managing macs in real environments, check out the following:

https://groups.google.com/forum/#!forum/macenterprise
http://krypted.com/
http://www.afp548.com/ /jussi

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

They've done a good job of making people forget this.

Re:eh, Google no eat own dogfood?

[steelfood]

But let's say Apple's shitting gold. Eating their poop might not be such a bad idea, especially if you have the tenacity to wait for it to come back out the other end.

Re:eh, Google no eat own dogfood?

[steelfood]

No, no it's not missed. What tends to be missed is that the needs of the content creator are different from the needs of the content consumer. Nerds, being almost exclusively content creators (i.e. the nerdier, the more significant the creations), find it difficult to understand the needs of the content consumer and see little value in appeasing it.

It's not wrong or bad, just how many of us see the world. On the flip side, people who primarily consume content do the exact same things. They can't understand why anyone wouldn't want something like a walled garden to keep them safe.

Re:eh, Google no eat own dogfood?

[CTachyon]

Care to share the Distro of choice on those linux based non chromebook machines? Is it a free employee option ? Are there a set number of pre-approved distros? Is there a top-secret Google Gnu-Linux Distro that dispenses chocolates on the half hour?

Only Goobuntu is available. It's Ubuntu Precise Pangolin plus some light policy customization (internal base-install *.debs; some Puppet stuff).

Re:eh, Google no eat own dogfood?

[Ksevio]

Google's main revenue source is from advertising, that doesn't make them an advertising company.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

I have a Chromebook and rely on SSH. There is native SSH via the Crosh terminal. It's even easier to import a key file into then Secure Shell.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

Oh, my, aren't you clever!

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

Royal Dutch Shell's main revenue source is petroleum + gas, that doesn't make them an oil company. Microsoft's main revenue source in Windows + Office, that doesn't make them a software company. Ford's main revenues comes from selling cars and trucks, that doesn't make them an automobile company.

Oh wait, that's all bullshit!

Fact: Google is an advertising company, and all of their services like Gmail or Google Search or Android or ChromeOS or that floating ballons thingy, are there so that their users will see more AdWord ads.

Re:eh, Google no eat own dogfood?

[killfixx]

It's "First of all" not "First all"...

It's the first in a list of all the items your going to talk about...

Hey, if you're gonna grammar Nazi someone...

Re:eh, Google no eat own dogfood?

[CTachyon]

I have a Chromebook and rely on SSH. There is native SSH via the Crosh terminal. It's even easier to import a key file into then Secure Shell.

True, it does exist -- I've used it myself -- but it's incredibly awkward to use and has some real oddities when it comes to terminal emulation.

Re:eh, Google no eat own dogfood?

[Anonymous Coward]

My main revenue source is from having sex for money, that doesn't make me a prostitute.

Re:eh, Google no eat own dogfood?

[synapse7]

It doesn't mean to eat your own shit, its a metaphor to use your own product.

Re:eh, Google no eat own dogfood?

[luis_a_espinal]

Sadly, missing the nuance of the English language a nuisance as well.

Not for a person whose first language is not English (that is, moi.)

how would it work in the real world?

[alen]

with companies less profitable than google?
Mac's are expensive
most people don't own Mac's personally
lots of people use personal computers to VPN to work
how would it work with the files on file servers people use to get work done? like MS Access databases?

Re:how would it work in the real world?

[Anonymous Coward]

Better yet, how does this remove the need for perimeter defense? It just MOVES the perimeter.

Re:how would it work in the real world?

[mspohr]

Both of my daughters have work issued Macs. One is in education and the other a tech company. When you look at the cost of a computer compared to the salary (and benefits) for an employee over the life of the computer, the cost of even an "expensive" computer is a small rounding error. In addition, the cost of protecting and cleaning up Windows computers is non-trivial and the cost of a data breach can be enormous.
This is not just a VPN, it is a VPN from a known, verified secure computer.
? MS Access... what a joke.

Re:how would it work in the real world?

[synapse7]

I'm curious what platform google is using for servers?

Re:how would it work in the real world?

[SirGarlon]

This is not just a VPN, it is a VPN from a known, verified secure computer.

The only secure computer is one that has never connected to a network.

Re:how would it work in the real world?

[Anonymous Coward]

? MS Access... what a joke.

Words spoken by a someone who obviously has never spent time in an office environment.

Re:how would it work in the real world?

[Anonymous Coward]

How do you run Windows programs? That is the number one reason corporation still OVERWHELMINGLY use PCs. What your daughters use is just an anecdote.

Re:how would it work in the real world?

[Buzer]

Publicly they have told they use Linux. As far as I know, no details have been released about on which distro it's based on (if any).

They most likely use some other servers as well on some projects (I would imagine they want to ensure compatibility at least), but they are also likely very rare.

Re:how would it work in the real world?

[mspohr]

It's widely known that they use x86 and Linux with a suite of supporting software known as the Google platform:
http://en.wikipedia.org/wiki/Google_platform

Re:how would it work in the real world?

[Anonymous Coward]

What does Microsoft Access have to do with VPN's?

Re:how would it work in the real world?

[lakeland]

I agree the cost of the computer is effectively a rounding error, but there are non-trivial costs in Window's favour too relating to compatibility.

It is getting a lot better with the rising popularity of Android / iOS meaning that fewer companies target a single platform, but I still find that when I try and take just my mac that I often find I have trouble doing some small thing.

Re:how would it work in the real world?

[mspohr]

I have spent time in a "big company" office environment... what a joke.

Re:how would it work in the real world?

[gmuslera]

It don't just move it, but makes it wider. More connecting infrastructure that could be outside their control, more points where a fake certificate could be used to gain access, provide ways to do MITM attacks, or just inspect traffic. In internal networks you must check traffic, the ultimate vulnerability is always the user and carrying inside a trojan without knowing should be common enough (and if not, taking advantage of a 0-day exploit in acrobat or flash definately is), but the physical location provides some security for some kinds of attacks.

Of course, they could assume that the added security would be marginal compared with other benefits.

Re:how would it work in the real world?

[mspohr]

It's best to just stay away from Windows programs.
If you think you need Windows programs or you work in a company that thinks it needs Windows programs, I feel sorry for you for working among the clueless zombies. Nobody needs Windows.

Re:how would it work in the real world?

[CMYKjunkie]

Let me give you a sad glimpse into my corporate world.

Cash-strapped organization of about 1700 employees. 2009-era Dell desktops and laptops. Windows XP, Office 2003, IE 8, homerolled mainframe applications from 1970s and 1980s mixed with Access databases, homerolled mainframe feeds Oracle financial backend.

IT has been "testing" Win 7/Office 2010 but STILL with IE 8 for over 1 year. "Should" roll it out organization wide in calendar 2014 replacing all machines with Dell laptops.

The cost of machines is NOT non-trivial in my world, at least to the bean counters. They feel like they cannot drag feet any longer on getting off XP.

Re:how would it work in the real world?

[Anonymous Coward]

If the cost of machines is non-trivial, upgrade to linux. Keep the old machines for more years - 2009-era machines perform fine with linux. Things gets faster, no hangs, no viruses. Replace office with libreoffice. No more windows/office licences needed when upgrading or expanding. Save money. Whatever "Business applications" using windows can run under wine.

Oh, and you don't upgrade all at the same time. Get some experience with the new setup, deploy for more and more with time.

Re:how would it work in the real world?

[tattood]

How do you run Windows programs?

The majority of the work that most employees do likely revolves around email or documents/spreadsheets/presentations, all of which have native OSX software.

For the few jobs that require software that only runs on Windows, there is always virtualization, or remote desktop into an MS terminal server.

Re:how would it work in the real world?

[dj245]

Both of my daughters have work issued Macs. One is in education and the other a tech company. When you look at the cost of a computer compared to the salary (and benefits) for an employee over the life of the computer, the cost of even an "expensive" computer is a small rounding error.

And yet I have not heard of a company doling out computers with SSD drives in them. Myself and a department full of people waste 15 minutes in the morning waiting for laptops to boot up. We did the math and the $ amount of the lost productivity was staggering.

Re:how would it work in the real world?

[Anonymous Coward]

Security through obscurity, hey if it's stupid and works, well it still works.

Re:how would it work in the real world?

[Anonymous Coward]

How the hell is this "Insightful?" This is pure drivel. Sad days for /. indeed.

Re:how would it work in the real world?

[Anonymous Coward]

I work at a company in the semiconductor industry. We have thousands of engineers of various types on staff, and they get to choose their personal systems (within limits) - either a desktop or a laptop system. Those that choose laptops overwhelming choose Apple. Some run their Apple laptops on Windows 100% of the time, some run Mac OS X only, some (like me) run both.

Personal choice is alive and well at some large companies.

Re:how would it work in the real world?

[SuricouRaven]

My workplace does.

I work at a school. All the IT course instructions are written assuming Windows and Office.

Do not underestimate the ignorance of users. If a menu item isn't in the place they expect it to be, they go calling for helpdesk.

Re:how would it work in the real world?

[ahodgson]

We haven't bought desktops or laptops with mechanical drives in over 3 years. SSDs everywhere.

Re:how would it work in the real world?

[vux984]

Only if people were going to actually work those 15 minutes anyway, and are now instead sitting there staring blankly at the wall.

Leading to an argument only an accountant would think would work:

So if you've got 32 people, just leave the PCs on at night, you can just add up those 15 minutes to reclaim an 8 hour day, and reduce headcount by one.

The rest of us know that giving them faster computers will just mean the computer comes on faster, and then sits there idle while they go get a coffee, say hello, check their phone for personal messages, make a phone call, deal with some paperwork, and all the other stuff they were doing anyway.

Sure, sometimes they were waiting for the PC. But how often is the PC waiting for them? Odds, are most of the time, so you can theoretically get your lost productivity back by just organizing your day a little better without buying new PCs.

Finally: Desktops, schedule them to power up 15 minutes before the day starts... laptops, teach people to sleep/hibernate instead of power down. My laptops are both usually ready to go within seconds; and they are both a few years old now.

Re:how would it work in the real world?

[xaxa]

And yet I have not heard of a company doling out computers with SSD drives in them.

My work computer has an SSD, it's great. It boots in a few seconds (to Ubuntu), and everything is really fast :)

Re:how would it work in the real world?

[Bill, Shooter of Bul]

MS Access, Really? I'd like to think those aren't used by anyone for anything serious. I haven't had anyone ask me to do anything with access in a long time. I hope that means they are really dead.

Re:how would it work in the real world?

[Anonymous Psychopath]

with companies less profitable than google?
Mac's are expensive
most people don't own Mac's personally
lots of people use personal computers to VPN to work
how would it work with the files on file servers people use to get work done? like MS Access databases?

About 30% of the folks in my company run Macs. In terms of sheer numbers not as many as Google but still multiple tens of thousands of users. We do use Microsoft's productivity suite extensively but use native versions of Office where we can, and Windows in a VM where we can't. I can't remember the last time I had to fire up my VM, though. The native VPN client works great, and I can also natively access CIFS file shares just fine.

Re:how would it work in the real world?

[WaffleMonster]

In addition, the cost of protecting and cleaning up Windows computers is non-trivial and the cost of a data breach can be enormous.

Currently the most effective and most used method of attack is social engineering. How are MACs less vulnerable and cheaper to fix? Please be specific.

This is not just a VPN, it is a VPN from a known, verified secure computer.

I've seen this technology before by various names yet the core principal by which it operates is fundamentally insane. Where the rubber meets the road you are essentially asking a potential liar if they are being truthful and acting on their response alone... "what a joke" indeed.

Re:how would it work in the real world?

[mspohr]

You have computers which take 15 minutes to boot up?
Every laptop I have owned for the past 10 years goes to sleep at night and takes about 10 seconds to wake up in the morning.
I think you're doing something wrong.

Re:how would it work in the real world?

[Anonymous Coward]

"This is not just a VPN, it is a VPN from a known, verified secure computer."

Uh huh. Insert obligatory, "Except for the NSA... and anybody who can deploy like resources..." here.

I seriously doubt that the NSA cares enough about my company's piddly internal LAN with VPN. My competitors don't have the resources. The NSA *does* care about sucking up as much Google as they can get. And when my competitor has a brother/nephew/best-friend-of-friend who would Lovegate it for them....

Yah.

So, this is just more "cloud is better and mroe secure" BS, as far as I'm concerned.

Re:how would it work in the real world?

[Bill, Shooter of Bul]

If he's stuck on Access, he's more or less stuck on Windows. He'd need some man power to convert those ancient DB files, It would be worth it in the long run, but he might have a tough time convincing managment of that. I'd suggust a skunkworks program done in secrecy over a period of time, then propose the solution when you already have it up and running in a back office.

Re:how would it work in the real world?

[larkost]

You have this a little wrong. The cost of the computers is trivial in comparison to other things. What you are seeing is that the bean counters are focusing on reducing one specific cost (computer hardware) without taking other costs into consideration (employe productivity). Undoutably this is a case of “penny wise, pound foolish”, and is probably because no-one can write up the other costs into a spreadsheet, so the one number that is easy to define wins.

This is what is wrong with the “if you can measure it, you can mange it” mantra that business schools have been drumming into MBAs for a generation now.

Re:how would it work in the real world?

[Billly Gates]

Not according to the cost accountants. Money is money and associated with salary as that is a different cost center etc.

Re:how would it work in the real world?

[Anonymous Coward]

That's a poor course. I feel sorry for the students

Re:how would it work in the real world?

[CMYKjunkie]

Oh we are stuck to Windows for sure. Our main web-based application (that simply glosses up the mainframe app because the daily data entries dumps over at midnight each night) is IE8-only. Some outside folks have used it with IE10 and it failed. Add in custom Word scripts that have carried up from Word 95 and I think you can kiss Libre Office or any other competitors.

And don't get me started that we are still tied to BlackBerry...

Re:how would it work in the real world?

[Jack Griffin]

It would be worth it in the long run, but he might have a tough time convincing managment of that.

Why would it be worth it? If what you have now works, then I'd love to hear your business case for me spending extra money to fix something that isn't broken. This is why IT nerds have little respect in most businesses, we're here to make money, not satisfy your religious requirements.

Re:how would it work in the real world?

[Anonymous Coward]

Yes, it's called "using a corporate Windows load" which includes lots of crapware to ensure that e-discovery, garbage databases, mandatory drive encryption, company anti-virus, trusted computing, and whatever other garbage works. You probably don't run a bunch of that stuff with roaming AD profiles at home, and at home, it's probably not managed by people who learned on-the-job from a bunch fo solutions which were cobbled together over a period of years by people who did not communicate or document anything.

My work laptop takes literally 12-15 minutes to cold boot into a usable, logged-in Windows 7 desktop. I am a professional [Unix] sysadmin with ~20 years of experience and could easily make this workstation boot much faster (either with a better OS or a better config for the current one), but one of the trade-offs of my current job is that we all use Windows workstations and we do not have local admin. Fine. It's not my computer, and I definitely bill that boot-up time when it happens every couple of weeks. I'd rather have a Linux box, but whatever; every job has something annoying about it, and this is pretty low on the list of problems one might encounter at work. :)

Re:how would it work in the real world?

[Anonymous Coward]

That depends on what you are doing. I am around 100% more productive working on either Mac OS X or Linux compared to Windows; and a Mac is a good option since it runs MS Office (which while not preferred, is needed due to that everyone else use it).

The extra cost for a Mac may be well motivated, especially for power users.

Re:how would it work in the real world?

[Anonymous Coward]

Finally: Desktops, schedule them to power up 15 minutes before the day starts... laptops, teach people to sleep/hibernate instead of power down.

That would waste twice as much time, as people would need to stop working and close everything for the daily reboot, instead of doing it overnight.

No, I'm not talking about Windows 98. I'm on Windows 7 (the last non-tablet OS from Microsoft), and one some days, I start to feel the need for the daily reboot an hour before it's time to shut down and go home. And this is an optimized Windows 7, with only VPN and Pidgin (not that big heavy Skype) starting up, but also one that is heavily used (three Visual Studio 2013 instances are not unusual).

Re:how would it work in the real world?

[Anonymous Coward]

Imagine if the lessons for learning to drive a car were written assuming a Reliant Robin.

Re:how would it work in the real world?

[number17]

I am completely intrigued by this 12-15 minutes from off to loaded desktop. It sounds like you've brought this up to your boss, as you are billing them for that time, and they have no immediate interest in fixing it. Sounds like an easy 15 minutes of pay.

Re:how would it work in the real world?

[eionmac]

similar corporate story. 4000+machines, 30% desktops circa 2000/2002 XP Pentium 4s, adequate for word documentation and spreadsheets, old corporate programs need to be upgraded/re-written from 1998 libraries; 60% 2004 laptops with XP Office 2010, new employees & machine failures put onto laptops win 7, MS office 2010, as basis of a slow upgrading. Change scheduled, funds allowing, to go all Win 7 in 2014 onwards with new laptops but company heavily indebted, so that is not a small beans rounding error in total even when compared to employee remuneration plus costs, it is real cash spend from borrowed money.

Goobuntu

[bobbomo]

What happened to their internal deployment of Goobuntu?
http://en.wikipedia.org/wiki/Goobuntu

Re:Goobuntu

[keltor]

Goobuntu runs on Macs just fine.

Re:Goobuntu

[Anonymous Coward]

The two Google teams I work with can't use Goobuntu because the Google Dart team decided to not allow Goobuntu, CentOS, Debian, or SUSE to run Dart by arbitrarily requiring gcc 4.6 or newer and glibc 2.14 or newer. In other words, Google no longer allows anyone to run Dart on any common Linux server OSes. Most of the guys I deal with run OSX or Windows on their desktops because of that.

Re:Goobuntu

[Anonymous Coward]

Clearly nobody at Google can figure out that they could easily compile their own version of gcc instead of using the package manager...

Re:Goobuntu

[imadoofus]

Is there not an admin that can install these away from the system paths, and set the environment accordingly?

Re:Goobuntu

[larry bagina]

gcc 4.6 is almost obsolete at this point. 4.7 is the minimum if you want half-decent c++11 support (The 11 means 2011, ie the spec was finalized almost 3 years ago after 8 years of deliberation). GCC 4.6 is almost 3 years old. GCC 4.7 is almost 2 years old. Is it acceptable to wait 3 years for 0-day exploits to get fixed? Is it acceptable to wait 3 years for a compiler that doesn't suck ass?

Re:Goobuntu

[petermgreen]

Ubuntu precise comes with gcc 4.6 and glibc* 2.15. So does Debian wheezy. So unless google is really really slow at updating their internal variant of ubuntu to the latest LTS release of ubuntu this shouldn't be an issue now (though it may have been an issue in the past and driven people to migrate).

* Strictly eglibc but afaict the difference is just in details surrounding some ports

Re:Goobuntu

[chad.koehler]

I wouldn't necessarily consider the choice of newer than 4.6 gcc arbitrary. Later versions with better C++11 support are very attractive, because C++11 simplifies and standardizes a lot of things that can make development significantly easier.

Re:Goobuntu

[Anonymous Coward]

> Debian wheezy

Stable is still 2.13-38:

http://packages.debian.org/stable/libs/libc0.1

The Google Dart team also decided to not allow Red Hat to run Dart. Google's irrational hatred of stable software is going to kill Dart. There's no way their target audience is going to run a bleeding edge desktop environment on servers. It's the reason we decided against using Dart. If we can't run it on a server, what in the hell is the point of the language?

Re:Goobuntu

[Anonymous Coward]

"gcc 4.6 is almost obsolete"

The newest versions of Red Hat and CentOS come with 4.4.7. 4.6 is still bleeding edge.

Re:Goobuntu

[smash]

Is it acceptable to wait 3 years for a compiler that doesn't suck ass?

I dunno, GCC has been around since before Linux existed and still sucks ass in many respects.

Re:Goobuntu

[Anonymous Coward]

Did you read the link you posted?
Goobuntu is a Linux distribution, based on the 'long term support'-versions of Ubuntu, that is internally used by almost half of the 20,000 employees of Google.
Bushnell explained that "Goobuntu is simply a light skin over standard Ubuntu."

Re:Goobuntu

[SnowZero]

The Goobuntu part is incorrect. Both my laptop and desktop have GCC 4.6.3 installed right now.

Re:Goobuntu

[Anonymous Coward]

So that's why the Google drones can't grok the problem. They're incapable fixing the problem since they're too incompetent to understand that there even is a problem. Besides the announcement that they are going to soon drop support for MSIE 9, not being able to run dart2js is the biggest reason Dart is dying. If you can't run it on a server, then it is doomed to be stuck forever as a tool used by hobbyists.

I wish Google would hire adults that have experience so someone could point out to the kids that work there that they are destroying the company with these "screw the professionals" type of decisions.

Re:Goobuntu

[Anonymous Coward]

I'm doing contracting at Google, and I don't have 4.6 on the version they gave to me. I have to reboot to run Windows to do my Dart development. It's very annoying that the company can't even get their act together well enough to run their own language on their own OS. It's a damn shame people with no experience are making horrible decisions like this.

I disagree with the guys that I work with that most people will compile and install updated versions of gcc and glibc. That just isn't going to happen.

Zero Trust

[bloodhawk]

What a coincidence. Zero Trust is EXACTLY what I have in google.

Re:Zero Trust

[SirGarlon]

Fortunately, this seems unlikely to affect you unless you already have access to Google's corporate network. TFA is about Google redesigning its own network, not (as I feared) to start providing some kind of cloud-based service to other corporations. The headline is misleading, perhaps intentionally so.

Re:Zero Trust

[interkin3tic]

Is there someone else who DOES have a trust value that is a positive number? If not, then can trust really be an issue worth discussing?

Re:Zero Trust

[Anonymous Coward]

What a coincidence. Zero Trust is EXACTLY what I have in google.

+1

Re:Zero Trust

[Sir_Eptishous]

not (as I feared) to start providing some kind of cloud-based service to other corporations.

Ahhh, but that is where this is heading.

Re:Zero Trust

[Anonymous Coward]

more and more businesses rely on google (god knows why). Imagine a business has a problem and calls google, "Sorry sir we currently don't have network connectivity as we don't operate a corporate network anymore, don't worry though we will give you a callback and start looking at your problem as soon as our local ISP is up again.

Re:Zero Trust

[Anonymous Coward]

Who do you trust, then? Why? Do you run all of your own services?

Google has mad a lot of unhappy enemies. Make sure your opinions are your own.

Why?

[Anonymous Coward]

My dog eats its own poop.

Why do they do this?!?

Re:Why?

[Anonymous Coward]

Because even the smartest dogs are quite stupid by human standards.

Re:Why?

[NatasRevol]

Vitamins.

Re:Why?

[Anonymous Coward]

But they're still smarter than the average cat.

Re:Why?

[g0bshiTe]

To get the taste of their owners face out of their mouths.

Re:Why?

[g0bshiTe]

Don't know about that, cats won't walk on a leash, a cat won't come when you call it.

Which would you consider smarter? Hint, it's probably the one that exercises it's own free will vs the will of it's owner.

Re:Why?

[mattack2]

Which would you consider smarter? Hint, it's probably the one that exercises it's own free will vs the will of it's owner.

Isn't it ironic?

Re:Why?

[retchdog]

free nutrients that didn't get absorbed the first time through.

even for humans, one's own feces are safe to eat, barring mouth sores and the like. there's nothing in it that didn't come out of you in the first place.

Re:Why?

[egcagrac0]

Dogs eat cat poop, too.

I've yet to see a cat eat cat or dog poop.

Re:Why?

[egr]

Wrong! Dogs are dumb, just easier to control and teach "tricks", since they are pack animals. Anyway, the cat's brain got twice the count of neurons than the dog's brain got.

Re:Why?

[kencurry]

posting to correct mod error - apologies.

Re:Why?

[retchdog]

some cats do eat their own poop.

dogs are more attracted to cat poop because it contains more nutrients; cats eat a diet heavily derived from organ meat, while dogs eat comparatively more bulk muscle.

Re:Why?

[Bengie]

There is a large amount of bacteria that is just fine in your lower intestines, but with wreak havoc higher in the chain.

Re:Why?

[Sique]

Actually, dogs are smarter than cats by all available measueres. Free will has nothing to do with intelligence.

Re:Why?

[vux984]

So you should cook it first?

Treat it like beef, and make sure you kill the e coli etc.

Re:Why?

[Valdrax]

even for humans, one's own feces are safe to eat, barring mouth sores and the like. there's nothing in it that didn't come out of you in the first place.

This is wrong. Bacteria are not evenly distributed throughout both the small and large intestines. Look up small intestinal bacterial overgrowth sometime.

Re:Why?

[Anonymous Coward]

In their defense, poop is not self toxic for most species, in fact it is toxic only to a very few: cows and humans are two.

Re:Why?

[styrotech]

So does that mean (from your link) that men are 21% smarter than women? And women just appear smarter because they're pack animals?

Re:Why?

[egr]

I do not exclude this possibility. On average probably. All this political shit about "everything equal and everyone the same" does not mean it is true. The are extraordinary people, and I know by far more extraordinary men then women.

Re:Why?

[LoRdTAW]

When I walk my dog, two stray cats join us for the walk. They happily follow us all around the block and were never afraid of the dog and the dog already lives with two house cats. So they may not walk on a leash but they will walk with you. I feed the two strays and provide outdoor shelter for them (plastic dog house I found in trash which I put a spare dog bed into). I would take them in if I already didn't already have two terrorists.

Re:Why?

[smash]

The available measures are somewhat broken though. Cats are just differently motivated. "Failing" an intelligence test that the cat has no interest in completing doesn't mean they're stupid.

Re:Why?

[n3r0.m4dski11z]

I must confess, you have an astonishingly good idea there doctor.

Re:Why?

[Anonymous Coward]

What if we accept the idea that men are smarter than women? I know that would be unacceptable to an awful lot of people. So what? If the evidence is there, it should be accepted. But that's not the way the world works. I know that, that's why I'm posting this anonymous. I've known women who were smarter than most guys I've met. I've known several of them. I've known a few men who where smarter than anybody, women included, that I've known.

I suspect that in reality the average man is not as smart as the average women but that there are more men who are at the top of the curve, and at the bottom, than women. That's just me and my experience talking though. If the science says that men are smarter on average, or if it says that women are smarter on average, I think it is a terrible shame that our society can't acknowledge facts for fear of being unacceptably politically incorrect.

People are valuable for more than their intelligence. Good people are sometimes, frankly, not bright. Bad people are sometimes damn brilliant. The value of a person is not encapsulated in their intelligence. If I were rebuilding the world to my own preferences, the intelligence test would be replaced by the greatness test, built on the idea that a person is measured by the choices they make.

Re:Why?

[TheSeatOfMyPants]

It also depends on how strongly the cat has bonded with you and whether they grew up with the same cats from a very early age, all of which also makes a huge difference in their/our ability to communicate. (I strongly suspect certain phenotypes also are more predisposed to bonding/working with humans than others; people think of it as a breed trait, but IME "lookalikes" often carry it as well.)

The species is surprisingly like children in terms of their intellectual/communicative development being profoundly affected by how/how much we interact with them and how nutritious their food is. (By nutrition, Imean good ingredients like brown rice rather than indigestible corn fillers; some of the really pricy USbrands like Science Diet or Iams are low-quality.) So most people's idea of a cat's mind is based on the equivalent of a little kid left in front of the TV & living off junk food, rather than one whose parents give it a great balanced diet, read to & played educational games with it, if you see my drift. It's no shocker most people's idea of a normal cat is an uncommunicative creature that's constantly exhausted.

FWIWI'm not a breeder, my cats are spayed/neutered early on. I learned what I know from spending vast amounts of time rehabilitating unwanted kittens & young adult cats that won't be given a chance at the local "no-kill" shelter (ones that would panic and/or attack at random due to being abused, unhandled, or feral) for almost 30 years.

Here's one hopefully-good example of what I'm talking about: a friend's ex-farm-feral 'informing' her that he wanted more canned food. He seemingly got the urge to communicate and amazing bond with her from the Korat phenotype he matched (breeders saw him at the hospital and asked who sold him).

Re:Why?

[Anonymous Coward]

Free will has nothing to do with intelligence.

What makes you say that?

Re:Why?

[bingoUV]

Lizards won't walk on a leash, and won't come when you call them. What does that prove? That lizards are smarter than most 6 year olds, and most dogs ?

Re:Why?

[Anonymous Coward]

If you're smart you keep quiet about it.

Re:Why?

[MightyYar]

If we are going to get into intelligence, both of those animals have one over humans. They get fed for free and we pick up their poop. All we get in return is response to cues that we mistake as emotion.

Re:Why?

[Anonymous Coward]

Shock news, women and men are both the same animal.

Ergo, to define one as a pack animal and not the others is flawed to say the least.

So no, it doesn't mean men are 21% smarter than women.

It does mean that you and the people modding you up are sexist arseholes of the weakest kind, so congrats on that.

p.s.

I'm a man. You may not like me standing up like this, but then you might have some beastiality issues you need to deal with, so yeah...

Re:Why?

[styrotech]

Sexist arsehole?

Wow that one went right over your head.

I was pointing out (via parody) the absurdity of his argument for cats being smarter than dogs based on numbers of neurons.

And the "appear smarter" bit was also a pre-emptive dig at all the sexist geeks likely to take it at face value.

Re:Why?

[Anonymous Coward]

I hear that about kids a lot. "Little Johnny isn't a retarded, he just doesn't apply himself because the teacher's don't challenge him! Why, he could be the president if he want- NO JOHNNY! FOR THE LAST TIME, STOP PUTTING YOUR TONGUE IN THE ELECTRICAL SOCKET!"

Re:Why?

[jwhitener]

And blue whales must be demi-gods.

that's how my corp network works

[trybywrench]

The rj45 jacks in the office are just plain old dirty connections to the Inet. We each have multiple OpenVPN connections on our localhost giving us access to different parts of the network depending on our roles. It's convenient because our workstations work identically wherever we are ( home, work, coffee shop ) and it's convenient when someone leaves because operations just invalidates the VPN certs and the former employee is cut off no matter where they physically are. A side effect is whenever your VPN credentials don't work you're left wondering is you're about to get fired and ops just jumped the gun haha.

Re:that's how my corp network works

[Anonymous Coward]

Same, the company I work for is distributed around the world, I can work from anywhere that has an internet connection.

We maintain an office but it's just seats and internet.

Re:that's how my corp network works

[Anonymous Coward]

yes, but if you seat down at the office, Is the computer you use behind a firewall and part of the "trusted network" or is VPN'd into a separate network. At my job it's parted of the trusted network but you can VPN into the trusted network and work any-ware. But the parents company's solution seams better. Just use VPNs to connect to all servers even at the local office desks. The extra security is actually just a bonus because you gain continuity of maintenance and user interface.

Re:that's how my corp network works

[Anonymous Coward]

You still have a traditional corporate network into which you VPN. Totally different to what is proposed here.

hacking ?

[fluffythdestroy]

I may be wrong with this but if your computer sends data to their meta inventory system, all the hacker needs is that data to replicate with some packet capture software and use that info to log in...wont it ?

Re:hacking ?

[Anonymous Coward]

wow. just wow.

maybe just start here

http://en.wikipedia.org/wiki/Transport_Layer_Security

Re:hacking ?

[hawguy]

I may be wrong with this but if your computer sends data to their meta inventory system, all the hacker needs is that data to replicate with some packet capture software and use that info to log in...wont it ?

Read this to see why you're right and wrong: http://en.wikipedia.org/wiki/Replay_attack

Re:hacking ?

[Entropy98]

I'm pretty sure they're using: Public-key_cryptography so no.

Biggest Apple shop?

[Anonymous Coward]

Ever hear of a place called Apple? Apple has about 80,000 employees, and I'm sure they average more than one.

Looooooong game

[Anonymous Coward]

Google lives in a fantasy world, where the WAN is as fast as the LAN. For me, both at home and in the workplace, you're talking about two and a half orders of magnitude difference. That's the whole reason all this cloud stuff, streaming (as opposed to download) video, etc all seems so bizarrely alien. You're talking about such a tremendous performance downgrade, that I just can't begin to really take it seriously.

I suppose the thinking is that they are planning for the future, when some day the WAN gets reasonably fast, where my home and business DSL line is replaced with fiber. Cool. Be ready, Google. But how are you going to spend those decades of waiting? Some cons are a little too long, IMHO.

Re:Looooooong game

[hawguy]

Google lives in a fantasy world, where the WAN is as fast as the LAN. For me, both at home and in the workplace, you're talking about two and a half orders of magnitude difference. That's the whole reason all this cloud stuff, streaming (as opposed to download) video, etc all seems so bizarrely alien. You're talking about such a tremendous performance downgrade, that I just can't begin to really take it seriously.

I suppose the thinking is that they are planning for the future, when some day the WAN gets reasonably fast, where my home and business DSL line is replaced with fiber. Cool. Be ready, Google. But how are you going to spend those decades of waiting? Some cons are a little too long, IMHO.

But how much data do you really need to send to your home computer?

I deal with multi-terabyte datasets every day, and can work just as effectively from home as I do from the office since my data lives on the server and I never need to bring it down to my computer. I rarely even compile code on my local computer anymore since it's so much faster to do builds on the 16-core 32GB servers than on my little 4 core 8GB home computer (and even worse on the old 2core 4GB laptop).

Likewise, I don't have a Windows computer on my desk - I remote desktop to the Windows Terminal Server when I need to run a Windows app. At long as I'm not streaming video, it works just as well from home (~12mbit DSL) as it does from the office.

Re:Looooooong game

[Bert64]

Then work in the office...
Google's plan is to do away with a local corporate network, so that the network available in the office is just an internet connection and you connect over the internet to whatever services you require. If you are in the office then your connection will be just as fast since the services you generally access are just as likely to be local as they were before. It's just that now instead of being on a flat network with insecurely configured devices, you will connect to those devices over a public network and they will be hardened just as you'd expect servers connected to the public internet would be, instead of assuming that only trusted employees can get to the servers and slacking off on server hardening.

Re:Looooooong game

[brausch]

Absolutely agree. I just use my remote machine as a device to connect to my at-work machines where all the work is actually done. No corporate data is ever stored on my laptop, just personal stuff in a few encrypted files.I occasionally tinker with code on my laptop but everything serious is done on my real servers.

Re:Looooooong game

[Zak3056]

Google lives in a fantasy world, where the WAN is as fast as the LAN. For me, both at home and in the workplace, you're talking about two and a half orders of magnitude difference. That's the whole reason all this cloud stuff, streaming (as opposed to download) video, etc all seems so bizarrely alien. You're talking about such a tremendous performance downgrade, that I just can't begin to really take it seriously.

I suppose the thinking is that they are planning for the future, when some day the WAN gets reasonably fast, where my home and business DSL line is replaced with fiber. Cool. Be ready, Google. But how are you going to spend those decades of waiting? Some cons are a little too long, IMHO.

Some thoughts on this:

• It my be fantasy for you and I, but Google actually lives in this world. When you can dabble in setting up gigabit city-wide networks as a freaking "experiment" it's reasonable to assume that bandwidth for remote connectivity isn't really an issue for you.
• 100kbit is more than enough to buy you a reasonably quick remote desktop session. If all your real work is being done in the datacenter across multiple redundant 10gbit links, then who the hell cares what the WAN connectivity is, as long as it's enough to get the session to the user?

Re:Looooooong game

[Zak3056]

Please excuse the formatting above. I really, really, hate that slashdot can't seem to handle lists anymore.

What about apples higher price and lack of hardwar

[Joe_Dragon]

What about apples higher price and lack of hardware choice??

Also there laptops are very limited,

Most are stuck with on board video, memory is built into the computer maxing at 16GB right now. At an $200 upgrade from 8GB. Want a NVIDIA GeForce GT 750M only in the $2600 system.

Flash storage only with 1TB MAX at an $500-$800 upgrade. Some systems are locked at 128GB PCIe-based flash storage or 256GB. And useing the cloud over wifi can very a lot 3g/4g/LTE fast in some areas but with high overage costs.

Built-in battery.

On the desktop the New mac pro has a very high price for an 1 CPU system and there is workstation work that does not need a lot of GPU power. Or may need a lot of storage.

mac's don't even real sever hardware

[Joe_Dragon]

mac's don't even real sever hardware and the laptops are unrepairable
http://www.cultofmac.com/251359/ifixit-finds-2013-retina-macbook-pros-as-unrepairable-you-can-get/

Re:mac's don't even real sever hardware

[Anonymous Coward]

hey, you don't even real sentences. priorities, priorities...

Re:mac's don't even real sever hardware

[Anonymous Coward]

Who cares about "real" Mac server hardware, when the only people using Mac OS X Server is small to medium business?

Like Google would run anything in their data center besides Linux anyway, and Linux loads pretty darn nicely into a VM hypervisor running on pick-your-blade-chassis-vendor.

Re:mac's don't even real sever hardware

[Anonymous Coward]

Not really an issue when your employees can just take their computer to any apple store and have them repair or replace. It might even be a cost savings if google doesn't have to keep as many onsite repair staff.

Re:mac's don't even real sever hardware

[Bert64]

Most corporate users, and home users for that matter have no idea how to repair computers. They will simply send it back to the manufacturer to be replaced.

Re:mac's don't even real sever hardware

[Sir_Eptishous]

Right.
They're called the Gapple Store.

Re:mac's don't even real sever hardware

[entrigant]

There are two good reasons to care about "real" Mac server hardware.

With the lack of proper Mac server hardware and the draconian EULA of OS X Apple has successfully avoided collecting untold sums of cash in licensing fees for VDI. It's embarassing. All they would need to do is either produce the hardware or allow virtualization of their desktop and server OS on non Apple hardware. After that some on their knees begging to Citrix and VMware would help to expedite support.

The second is build farms. One of the most embarassing things I've ever had to do is _rack_ a cluster of mac mini's. It's so, so sad: http://mk1manufacturing.com/store/cart.php?m=product_list&c=17.

Genuinely Interested

[Anonymous Coward]

I'm genuinely interested in this. You say repeatedly that it is convenient, but running a bunch of openVPN tunnels from my desktop/laptop doesn't sound convenient at all. The number of issues I have getting my openVPN connections through firewalls and NAT is very discouraging.

Please tell us more about your setup.
What type of work does the company and you do?
Approximately how many users work like this?
Does this company operate primarily as a standard physical office environment, or is this a distributed(work from home) startup?
Where are the servers, on-site, datacenter, cloud?
Approximately how many servers?
What type of applications are used, web, small applications like QB, MS Exchange or SQL systems?
What are the negative aspects of this system?

Re:Genuinely Interested

[Anonymous Coward]

Interestingly, the company I work for is also like that. In our office, the "network" is just a regular consumer grade router (plus an expensive cisco AP). But we don't use VPNs (VPNs suck), all of our services are Internet accessible and protected independantly. So web-stuff is SSL + http authentication, email is IMAP, calendar is caldav. source code is ssh+git, etc. We have an internal SIP service (but that's also Internet connected).

Also, look at how large open source projects operate, Mozilla, Debian, Gentoo, GNOME, KDE, LibreOffice, etc. They're all a bit like big companies, but without a VPN, where everything is Internet accessible.

We don't use any internal application that's not web-based, does anyone else do that?

Re:Genuinely Interested

[Anonymous Coward]

Yeah. Regular people use IPSec. However, Linux _sucks_ at IPSec, in that it's even more painful to configure and maintain than OpenVPN (which is kind of simple, until it doesn't work). If you want a free IPSec solution, I suggest OpenBSD. You can get a dynamic tunnel up with a _single_ configuration line. And they just added LT2P a couple of releases ago.

Goodbye Cisco. That was their last killer feature, IMO... IPSec.

Re:Genuinely Interested

[Zarhan]

I don't know about OpenVPN, but for example Cisco Anyconnect is pretty flexible for this kind of stuff. It uses IKEv2+IPSec if possible, then scales down to DTLS, and finally just https (even through proxy if necessary), and as such, can pretty much punch through any firewall. In addition, you get endpoint assessment so you can for example enforce that any updates and such things are installed to the employee's device (whatever that might be).

Re:Genuinely Interested

[trybywrench]

I'll answer as best as I can

> Please tell us more about your setup.
We're a Java office in TX with a remote call center in OR and a handful of remote employees ( Chicago ).

> What type of work does the company and you do?
I'm the director of development, we're a j2ee web application development shop with special expertise in Oracle

> Approximately how many users work like this?
All of us ~30

> Does this company operate primarily as a standard physical office environment, or is this a distributed(work from home) startup?
A couple of my developers work from home 3 days a week and most of ops ( the network guys ) work from wherever and, apparently, whenever they want. They're pretty hot shit, published authors, speakers at LISA, etc so they're left alone most of the time.

> Where are the servers, on-site, datacenter, cloud?
We keep our staging and UAT servers on site and colo for production + another colo for failover

> Approximately how many servers?
I have no idea, I know we have some serious SAN gear for the databases. We probably have around 50 virtual servers in our testing setup and maybe 20-25 production server clusters with an average of 3 nodes each. Some physical some virtual.

> What type of applications are used, web, small applications like QB, MS Exchange or SQL systems?
Web applications, we develop/maintain some very large rewards and loyalty programs for the big banks. RDBMS is Oracle, email and IM is handled through Zimbra, project management is handled with Atlassen Jira self hosted.

> What are the negative aspects of this system?
The only problem i've ever faced is the VPN endpoints not staying connected. VPN connectivity becomes mission critical because without it no work can get done. I don't know what they're using for the VPN server, I know ops is a big fan of OpenBSD so it wouldn't surprise me if that's what they are using.

Re:Genuinely Interested

[Anonymous Coward]

Cisco devices blow, and so does their client software. Use others, maybe OpenSwan.

Re:Genuinely Interested

[Anonymous Coward]

"The only problem i've ever faced is the VPN endpoints not staying connected."
so users have connectivity issues... and your network designer is not fired?!!!!!!

Re:Genuinely Interested

[trybywrench]

One other thing. I work on an Imac and use TunnelBlick to manage the VPN connections. I've had zero issues on a wired connection but sometimes have issues using wifi, the vpn connections will drop and then re-connect after a minute or two. There must be something weird in the office because when I take my mac home i have zero issues on wifi.

Re:Genuinely Interested

[Anonymous Coward]

With 30 employees I can see that being manageable. From an administration perspective I don't see how it could scale. It is not like an average employee at a non-tech company can set up VPN connections on their own reliably.

Re:Genuinely Interested

[trybywrench]

yeah when i started it was "here's your certs, here's the VPN server IP.. by and don't talk to me ever". I could see it being difficult for a non-tech person to get setup.

Re:Genuinely Interested

[Bert64]

Endpoint assessment is a stupid idea, a malicious (i.e. owned) client can easily lie to the server while a legitimate user wanting to use a configuration not thought of by the sysadmin gets screwed.
Also having to use a proprietary client is terrible, you end up being unable to update your OS because doing so can break the third party vpn client, or finding yourself with extremely restricted choices as to what os you can use.

Re:Genuinely Interested

[Anonymous Coward]

Just to add...we use a similar setup. All our work-at-home employees use OpenVPN on a variety of platforms (mostly Windows, several Macs, handful of Linux). All our physical locations have a Linux router that keeps an OpenVPN tunnel to our server farm in Amazon EC2. Works beautifully, and since the entire LAN is tunneled via OpenVPN, don't have to worry about users setting up their own VPN clients.

Re:Genuinely Interested

[LDAPMAN]

Try Viscosity. http://www.sparklabs.com/viscosity While it does cost more than TunnelBlick ($9), it's still cheap and it's much more polished and reliable.

Re:Real Unix makes the difference.

[ArcadeMan]

Why would Google buy Macs if they don't use OS X? They could use Linux on ANY cheaper computer they choose but bought Macs anyway.

I believe Google thinks like a lot of us: OS X for desktops, Linux for servers, a mix of iOS and Android for mobiles.

Perimeter-less networks

[tippen]

From a security perspective, Google is right about the notion that your internal corporate network being "safe" is dead. Between all the laptops, tablets, smartphones and very portable USB devices, there really isn't a secure perimeter on your network. Security needs to be applied at each entry point to the network, whether that is wired (internal or external doesn't matter), wireless or virtual.

The summary implied that the need for security devices goes away once you give up the idea of a perimeter, but that isn't the case at all. The form that security comes in may change, but you still need it. Authenticated users connecting via secure tunnels doesn't eliminate the risk of malware, so you still need IPS and anti-malware devices (Fidelis, FireEye, etc.) to keep your protect company assets from valid authenticated users.

If you can't trust any of the devices on your network, then you need to inspect 100% of the traffic entering the network.

Re:Perimeter-less networks

[dkleinsc]

My thinking on this is a bit different, and boils down to this principle: There's still a perimeter, but most of the office is outside of the perimeter.

Re:Perimeter-less networks

[Anonymous Coward]

Google is right about the notion that your internal corporate network being "safe" is dead. Between all the laptops, tablets, smartphones and very portable USB devices, there really isn't a secure perimeter on your network.

This. Especially with CIOs getting excited about BYOD. (Personally I think BYOD is a disaster waiting to happen, but whatever.)

Re:Perimeter-less networks

[tippen]

My thinking on this is a bit different, and boils down to this principle: There's still a perimeter, but most of the office is outside of the perimeter.

So what do you include in your version of a perimeter?

Re:Perimeter-less networks

[Bert64]

Not at every entry point, security should be a serious consideration on every device. Work on the assumption that everything is directly exposed to the internet and start from there.
Trying to only monitor the entry points is the problem, if anything makes it past your entry points then it could have free reign over everything inside.

Re:Perimeter-less networks

[tippen]

Personally I think BYOD is a disaster waiting to happen, but whatever.

If you don't trust any device connecting to the network and IF you are able to apply appropriate security inspection to all of the traffic, does BYOD actually matter? From the security perspective, I'm not sure it does. That said, I tend to agree with you from multiple other concerns: IP protection, compliance, backups, support, etc.

Re:Perimeter-less networks

[tippen]

Not at every entry point, security should be a serious consideration on every device. Work on the assumption that everything is directly exposed to the internet and start from there. Trying to only monitor the entry points is the problem, if anything makes it past your entry points then it could have free reign over everything inside.

When I said "entry point", I didn't mean the perimeter. I meant at every single connection to the network... the RJ45 you plug into in your cube, the wireless AP you connect to with your laptop or smartphone, the vNIC in your virtual server, etc.

Re:Perimeter-less networks

[Anonymous Coward]

The server(s) itself.

Re:Perimeter-less networks

[dkleinsc]

If we have servers somewhere in the office building, "inside the perimeter" includes: Physical access to the server room itself, a server subnet, with a firewall to the office as well as the outside, and designated workstations in the server room accessible only to sysadmins and with no outside network access that allow them to modify the firewall and otherwise work inside the perimeter when they need to. If the servers aren't somewhere in the office building, then you set up a way for your sysadmins to get a backdoor to the firewall between your office and the server racks in the data center.

The goal here is to have it so somebody could walk in with an infected iPhone, plug it into your network, and while the office may be in horrible shape in a matter of hours your servers are just fine.

Re:Real Unix makes the difference.

[michrech]

If I'm not mistaken, OSX was based on BSD, not Linux...

to bad Mac OS is not on more hardware

[Joe_Dragon]

to bad Mac OS is not on more hardware or even stuff that is not cut down / made very hard to fix due to being thin.

expensive" computer is a small rounding error but some mac system can end up costing X2 or more then the cost of a PC.

the new mac pro will have it's high cost added to by all the cost over head of expansion boxes and cables. With a lot's of power bricks.

Re:to bad Mac OS is not on more hardware

[aztracker1]

How exactly is your example much different from any other Laptop.. the Dell laptops here (about half mac, half dell) have docking stations, and adapters needed for using HDMI in conference rooms just like the macs do... your additional cost example really makes no sense.

Re:to bad Mac OS is not on more hardware

[Jack Griffin]

Maybe because Apple uses proprietary cables and connectors that costs a lot more than standard equivalents? I've run shops with both Apple and Wintel and Apple costs more than twice as much when you factor in all the fluff. If you think that is a rounding error then you have a lot to learn about running a business.

Re: to bad Mac OS is not on more hardware

[aztracker1]

No, but the difference between a $1200 Dell setup and a $2000 Apple setup compared to the salary of a $100,000 employee plus benefits is pretty famed small... I run windows Mac and Linux pretty regularly... I don't really see too much difference in one way or another... Windows has better infrastructure management tools and a greater attack vector... Mac has a shiny shell and a more consistent ui.

Re: to bad Mac OS is not on more hardware

[Jack Griffin]

You keep mentioning this difference as a ratio of employer salary as if this matters. Should I also use this excuse to buy a $6000 desk? a $2000 chair? $10000 coffee machine? Where do you draw the line at servicing your $100k employees? Running a business is about increasing profit and reducing costs. Increasing your Capex by 100% needs a better justification than "Shiny".

Re: to bad Mac OS is not on more hardware

[aztracker1]

I don't know.. maybe to keep your $100K+ employees happy? Employee churn costs about 3-6 months of salary for skilled positions of an employee with over a year of tenure in a company. Personally, I don't care *that* much... why don't you get your employees chromebooks? Then you can reduce your Capex by 80%.. YAY!

Re: to bad Mac OS is not on more hardware

[Jack Griffin]

No need to be silly about it. Most people expect Windows is standard, just as they expect a standard chair and desk. If an employee threatened to walk because I wouldn't upgrade their Dell for an Apple the I'd be happy to let the jerk go.

Re:Real Unix makes the difference.

[unixisc]

They picked a company that stands behind its platform over a platform that has no clear owner. It has nothing to do w/ how 'real' the UNIX is, or the license (okay, that may be a factor) or whether the company itself makes an arguable alternative.

Re:What about apples higher price and lack of hard

[ArcadeMan]

I agree with you that GPU options are very limited with Macs, but why the hell would onboard video and 16GB of RAM not be good enough for regular desktop work?

Re:Real Unix makes the difference.

[hawguy]

Why would Google buy Macs if they don't use OS X? They could use Linux on ANY cheaper computer they choose but bought Macs anyway.

I believe Google thinks like a lot of us: OS X for desktops, Linux for servers, a mix of iOS and Android for mobiles.

Because Apple makes good, attractive, hardware? Besides, hardware cost is inconsequential compared to the cost of a developer, whether his laptop costs $1500 or $3000 doesn't matter. Our entire development team uses Macbooks - and of 12 users, only two of them run OSX. One of them is even geeky enough to paste a Tux logo over the light-up Apple logo.

Since they deploy on Linux servers, it makes sense to develop on Linux. Write-once run-anywhere still isn't a reality - obscure platform specific bugs can still come back to bite you.

Re:What about apples higher price and lack of hard

[Anonymous Coward]

Oh boo hoo. 8GB RAM / 256GB SSD is plenty if you use your machine to run terminals, browsers, and text editors.

All the "real" processing probably happens on servers.

Re:Real Unix makes the difference.

[su5so10]

Google development is done on Linux but Mac laptops at Google run MacOS. Laptops (or chromebooks, there's a mix of both) aren't used for development (except via ssh, etc); they are used for email, web, etc.

Re:What about apples higher price and lack of hard

[Overzeetop]

You're kidding, right? Google - home of the cloud - is going to worry about local storage limits on drone machines. And...again...drone machines - onboard video is probably 4x as fast as they need it to be for nearly all conditions. They've rolled out fiber in an entire town; I'm going to guess that they've got a pretty speedy wireless system on campus.

Apple hardware is very limited if (a) you're looking for a bargain and aren't on a corporate buying plan, or if you're a hardcore gamer, or if you are running massive analysis software, or you are locked into industry software packages which are platform locked. None of that is an issue for desk machines at Google.

I'm not, in any way an Apple fan, but pretty much none of the problems you state are of any consequence to their usage profile.

Re:Real Unix makes the difference.

[su5so10]

Well, based on Mach 2.5, which contained BSD 4.4 and Mach kernel code.

Re:What about apples higher price and lack of hard

[Joe_Dragon]

It's more about the locked ram choice then the size of it. 16 Is good now but 4 years down the road?

Re:What about apples higher price and lack of hard

[Anonymous Coward]

4 years is easily longer than average corporate update cycle. Feel free to say that's crazy but that's how it is -- and in any case the people who use computers for more than 4 years probably aren't the most demanding users.

A slashdot first....

[mevets]

They buy Apples to save money?

Cue the frothing idiot tax minions....

Re:A slashdot first....

[gstoddart]

In this case, it was shitty Dell machines running Windows. Shitty HP machines running Windows also become a common choice.

Re:A slashdot first....

[rjstanford]

Eh, my company spent more money on macs - but most places with ~35 employees have at least one "IT staff" guy and we never bothered with one - the savings more than made up for the "idiot tax." Besides, if you're even a few minutes more productive per week not dealing with an OS issue the nicer laptop pays for itself, and if the employees get a better experience that helps retention... there's a lot more to a good decision than just the number at the bottom of the credit card receipt.

Re:A slashdot first....

[iluvcapra]

They buy Apples to save money?

They have a "you spend your own computer budget" policy, coupled with a company store, to save money.

Re:A slashdot first....

[pnutjam]

35 employees is more like a once a week IT guy, not an on staff guy. Unless your company has special needs, or a really poor setup with some Cert monkey.

Re:A slashdot first....

[rjstanford]

I've seen it more often that that, but even granted - a once a week IT guy's time still adds up...

Re:Real Unix makes the difference.

[toppavak]

Our entire development team uses Macbooks - and of 12 users, only two of them run OSX. One of them is even geeky enough to paste a Tux logo over the light-up Apple logo.

The last time I visited Google HQ (about 5 years ago) the most common setup I saw was Thinkpads running Linux with Macbooks running Linux in a close second.

I don't get why don't more developers use Linux

[Daniel Hoffmann]

I have been using Linux as my dev station since I started working full time and I have to say that the customizability is a big plus to productivity. Also, if you use default ubuntu unity UI you are barely one step above windows.
Being a developer is a craft, take your time to tune your tools.

Re:I don't get why don't more developers use Linux

[smash]

Because it's more of a pain in the arse than OS X to set up and make work with other systems, and doesn't really do much of anything that developers care about that OS X doesn't do. Other than run on cheap crappy hardware (been there, done that, been a Linux user since 1996. My primary machine has been a MacBook Pro since 2011.

Re:I don't get why don't more developers use Linux

[Anonymous Coward]

I hear that you are not using the shell very much. Or have your product installed on a Unix machines. MacBooks are great, its to bad they screwed up the filesystem and installation behavoir. If it wasnt for that a Mac would be more or less a Linux machine, a developer machine that is.

I do not know how I should survive without my Linux machine.

Re:I don't get why don't more developers use Linux

[Daniel Hoffmann]

How exactly? I have never had problems to set up anything on my Mint install, apt-get handles all the installations I need and I made a point that you should customize your own environment on my last post. For example I used to run a very customized version of blackbox before switching to cinnamon which I also customized to a lesser extent.

Granted I have almost no hands-on knowledge of macs and I work at a java / open source shop and these things are easy to set up on linux. But I _heard_ that command line capabilities are not as good a linux which is a major thing to worry about if you are a dev.

Network vs. intranet

[Anonymous Coward]

The second you connect the thing to the Internet it's just a subnet that happens to be corporate-controlled. You will still need firewalls et al. to keep appliances from getting pwned by undocumented network vulnerabilities but this is more a logical retreat from "we must defend the users!" to "to hell with the users, the servers are the only thing that matters."

Ironically the NSA has probably done more to push IPv6 and IPSec than any other organization on the planet.

Thanks

[Anonymous Coward]

Thanks for your response.

Elucidating.

Re:What about apples higher price and lack of hard

[Anonymous Coward]

It's more about the locked ram choice then the size of it. 16 Is good now but 4 years down the road?

4 years down the road the machine goes into the bin. What part of "corporate upgrade cycle" are you fuzzy on?

Exactly the reason to BEEF up your defenses

[Anonymous Coward]

To keep those nasty data slurpers at Google (nee NSA) out of your business. What goes on inside your business is nothing to do with the Chocolate Factory.

You (corporate IT) might even go so far as to put Google/G+ and everyother Google site on your company blacklist.

To paraphrase Pink Floyd
"We don't need no google education"

and what about the data?

[Joe_Dragon]

Some places like to have so IT'S EASY to take out the HDD for data security. HP, dell and others even let you destroy the HDD when going under an warranty replace.

Will apple do that?

Re:What about apples higher price and lack of hard

[brausch]

Four years from now I'll be using a one year old machine. :-) Any developer that I'm paying good money to is worth a new computer every three years. Compared to salary and benefits the cost of hardware is minimal.

Re:What about apples higher price and lack of hard

[Sir_Eptishous]

or you are locked into industry software packages which are platform locked.

The reason behind Microsoft's hegemoney.

Re:What about apples higher price and lack of hard

[Joe_Dragon]

well some places to do push 4 years but with apple 2 years is out of date for some systems.

Isn't Apple the enemy?

[Anonymous Coward]

I'm really surprised they don't just have a third party build Linux boxes to spec. Why give money to Apple who wants to put Google out of business?

Re:Isn't Apple the enemy?

[smash]

Because additional cost to just buy apple instead of some other vendor = far less than the cost to re-invent the wheel. And you end up with nicer hardware to use (in terms of screen, trackpad, keyboard) and third party support from a major vendor with stores and support staff all over the world. It's a no brainer really.

Heh.

[djyrn3715]

"...staff only allowed to use Windows with a supporting business case." That's why MS feels scroogled.

Re:Heh.

[lord_mike]

Good one! When I read that line in the description, my first thought was that they were spending a lot more money to get apple stuff, but then I remembered that Microsoft corporate licensing is an expensive nightmare. They are probably getting a better deal from Apple, which is incredibly ironic.

Limited to IT companies?

[billcarson]

In their whole talk they assumed the users of the services know what they are doing and how to behave. I'm sure that in Google's case all their workers are well trained, but I sure as hell couldn't allow VPN connections to our CRM database. Who knows what workers install on their laptops once they leave the office.

Re:Real Unix makes the difference.

[SuricouRaven]

The mac pro (not the ashtray version, don't know what that's like) is still a solid workstation. You can cram 64GB of ECC RAM in it quite happily. I don't know how long Apple will keep making things like that though, now it's evident there is a lot more money to be made in the consumer market.

Re:What about apples higher price and lack of hard

[Anonymous Coward]

> Also there laptops are very limited,

Where laptops? Your post doesn't make a damn bit of sense.

Re:What about apples higher price and lack of hard

[Anonymous Coward]

Your post is hilarious in the context of an article about Google only buying Apple machines. Was it intentional, are you posting in 1993 or do you not understand what hegemony means?

Re:Real Unix makes the difference.

[thetoadwarrior]

Because any cheap laptop is just that cheap. With the exception of the thinkpad (and even that can be a bit bulky) most laptops are still kinda shit. Macbook Pros are easily the best laptop you can have even if you never run OSX.

Re:What about apples higher price and lack of hard

[Anonymous Coward]

"Out of Date" isn't the same as "No longer does what it was bought to do".

I've never seen anyone upgrade the RAM in a Windows laptop in our workplace (~5000 employees) - and they're often woefully underspecced to start with, but they still get used for 3+ years - and then handed down to some poor newbie. So I fail to see why Google using Macs would be any problem, no matter how non upgradeable they may or may not be.

Remember that Corporations are not enthusiasts, they have a _completely_ different set of expectations for technology.

2-factor authentication helps ...

[perpenso]

Keylog and steal their credentials and you've got a jumping off point to worm in to the rest of their network.

2-factor authentication helps, the key logger can only get one of the factors. The second, say a time based one time password (TOTP), is still secure.

Re:2-factor authentication helps ...

[segin]

And here I've been hawking RFC 6238 to people as the next best line of defense for end-users all week long.

Re:What about apples higher price and lack of hard

[Anonymous Coward]

but with apple 2 years is out of date for some systems.

You have actual facts to back this up, right? Because otherwise you're spewing bullshit. Let's take some examples from recent Apple OS version. Mavericks runs on:

iMac (Mid-2007 or later)
MacBook (13-inch Aluminum, Late 2008), (13-inch, Early 2009 or later)
MacBook Pro (13-inch, Mid-2009 or later),
MacBook Pro (15-inch or 17-inch, Mid/Late 2007 or later)
MacBook Air (Late 2008 or later)
Mac mini (Early 2009 or later)
Mac Pro (Early 2008 or later)
Xserve (Early 2009)

iOS 7 runs on:

iPhone 4 and later
iPad 2 and later
iPad mini
iPod touch (5th generation)

So a 3.5 year old phone, a 2.5 year old tablet and so far the 2 year old iPod Touch and they are continuing to get all the point releases. Even the 4 year old iPhone 3GS got iOS updates to 6.1.3.

So, unless you have some evidence to the contrary you're full of shit.

Re:What about apples higher price and lack of hard

[Anonymous Coward]

So to wrap up, the only products that have only been supported for 2 years are those things that are only 2 years old. Basically everything else is from 3 to 6.5 years old.

Previous name for cloud...

[klubar]

I believe the earlier name for "cloud services" was timesharing. The 70's called and want their VM370/TSO back.

Android is hosted on Linux ...

[Anonymous Coward]

Apple devices != MacOS. Google itself runs on Linux. Android is based on Linux. So yeah, you're trolling.

Android is hosted on Linux, not based on Linux. Android users can't and most developers don't see Linux. Developers have to jump through hoops (NDK) to even see Linux.

Re:DA

[Anonymous Coward]

Not sure why you got modded down. This is exactly what DirectAccess was created for and many organisations are leveraging it, I guess because you put the word Microsoft in your post.

Re:What about apples higher price and lack of hard

[smash]

People keep bitching about the limited hardware choices with apple gear, but the simple fact is that whilst you may think you're getting something big by being able to tweak spec to the Nth degree, you simply don't. Games being an exception, somewhat.

The big performance jumps are had by upgrading from one generation to another, not by obsessing over minor differences between particular models of part within a particular product generation.

Re:What about apples higher price and lack of hard

[smash]

4 years down the road the box is out of warranty/support and you'll get a massive performance jump by upgrading the machine - far more than sticking an extra few sticks of RAM in the box will give.

Re:What about apples higher price and lack of hard

[smash]

Given that apple offer applecare on machines for 3 years, false statement is false.

Have some manipulative Google

[Anonymous Coward]

"This webpage has a redirect loop"

Re:What about apples higher price and lack of hard

[Anonymous Coward]

On a workstation, I get dual Xeon, thats 12 cores, and up to 256Gb of memory.

Say again, why are you using mobile cpus with 16Gb of memory _today_? My workstation is now ready to be replaced, its three years old has 4 cores and 16Gb of memory. That machine is for me now depricated, its to less horsepower, to less memory, simply its starting to feel slow. And this machine is still "State of the art" when you compare to laptops.

As a developer I ask myself, WHY? WHY laptop? WHY?

Biggest Apple Shop?

[bl]

I know this isn't the main point of the article, but I don't think Google can really claim the largest deployment of Macs. I think Apple's own deployment must be far larger. Per the 2013 annual report, Apple had 80,300 full-time equivalent employees. Then consider the possibility that Apple may outsource a large portion of their customer service, tech support, sales, and other customer-facing (non-retail) workers. Those people might work in remote locations, but would have to be using Macs connected to Apple's corporate network. I think 120,000 Macs would be a conservative estimate for worldwide deployment covering HQ/corporate, Apple Retail, AppleCare, Apple Online Store, iTunes/App Store, plus the staff that serve niche markets like education, enterprise and public sector. So I'm afraid Google can't claim #1. However, I can't think of any other company that could even come close to Google's number, so they're probably secure in the #2 spot. Plus, this number says "Apple devices" so if you include mobile devices, Apple's own number would almost certainly surge past 200,000.

I think they have a point

[jimicus]

The idea of a secure network and a VPN to get into it if you're working away from the office is all very fine, but the list of problems it throws up is huge - and it just gets bigger as your company expands:

  - You almost invariably wind up with a two-tier experience. People who are in the office and get nice fast access to everything and people who are out of the office and everything's dog slow. Oh, sure, you can reduce this problem somewhat by putting servers in a colo, but now you've got to engineer systems so you don't wind up with everyone getting the dog slow experience. (I'm particularly looking at legacy file servers here; SMB was never really designed for use over a slow, high-latency link, though I understand newer versions of Windows Server have mostly cracked this).
  - You don't gain an enormous amount of security. Even with a heavily locked-down perimeter firewall it's seldom that difficult to figure out a way to get information out, as long as you can get something nefarious in. And that really isn't difficult with a little light social engineering.
  - Expanding beyond one office gets very expensive very fast. You need to be looking into Terminal Server, very fast (=expensive) links or have branch offices put up with terrible application performance. IT as an industry automatically assumes that multiple branches = huge business with a huge budget that takes IT very seriously (seriously, throw that bit of information into any proprietary system you're pricing up and watch the price skyrocket). I can tell you now that every single town has loads of small businesses spread across multiple branches that don't have a huge budget, don't feel the need to dedicate enormous resources to IT and they are absolutely loving the various web-based products such as espoused by Google.

Oh, sure, there's a lot of business applications that are designed on the assumption that you're a company in just one office - or if you have several offices, you have gigabit links between them - but I don't think Google really need to care too much about those.

Re:I think they have a point

[Agronomist Cowherd]

The way to fix that is to just use remote desktop over the VPN. Then the machine that needs fast access to the files is on the fast network. You have fast access to everything that way. The machine that displays the desktop can be anything, and cheap; the machine that you really use can be fully virtualized (although I just use a regular desktop at the desk I never visit; it could be moved into a data closet or onto a shared VM box and I wouldn't care).

About the only thing that doesn't work well over VPN remote desktop is video (a smarter remote desktop could deal with that, but I haven't seen it personally). My job doesn't involve video at work anyway.

More PR fluff

[Anonymous Coward]

Google = Zero Trust

WTF does =/= mean?

[Anonymous Coward]

Really I don't know.

Re:What about apples higher price and lack of hard

[Anonymous Coward]

Should be OK, but I agree, not great.

Re:What about apples higher price and lack of hard

[Anonymous Coward]

Not really. MBP last a long time physically. My wife's was bought in 2006 and is still 100% OK (with 3 changes of battery and one change of HD). Fine if you want an OK laptop with low end characteristics (2GB of RAM is the main problem)

My take on this

[maharvey]

Google had implicit trust due to laziness and ignorance and the whole benefit of the doubt thing. Google knew all along there is no actual privacy, but their customers didn't see it as an issue, and Google profited off the difference - exploiting and selling that data that their users did not think to protect, and offering cloud services to people who did not consider whether the cloud was secure.

The NSA scandal blew that wide open. Now their whole business model is in jeopardy. Where previously they said trust us, now everyone is saying lets go overseas to find someone trustworthy. Trust cannot be regained, so what Google needs to do is convince everyone that trust is not an issue. You can't trust us, but you really shouldn't trust anyone. And look: it won't impact your profits, and it fact it will save you a lot of money.

So Google is eating their own dog food, playing their own guinea pig. They'll work out the technologies on themselves. They'll say look its working for us, and you should do this too. If they can pull this off - simultaneously eliminate trust and save money doing it - corporate America will be compelled to follow whether they like it or not, because they can't deny the dollars. And like sheep, the public will follow whatever their corporate overlords are doing.

This has an additional benefit: Google can now say to people: hey privacy isn't our problem, it's yours. If you have something to hide that's your responsibility. This can of course be spun as "save the children" vs. "hiding criminal activity from the NSA" to give it some teeth. It lets Google totally off the hook and gives them carte blanche to do anything they want with your data. I'm thinking they'll still give us the tools to do it, but they know that most people are too lazy and complacent to bother, and those few smart or paranoid enough to do to do it will only make themselves targets to the gov't. Except for corporations, who get a free pass to maintain privacy. Once the ecosystem shifts to no trust and no privacy, and laws are passed restricting "technologies that could be used to conceal criminal activity," it will be hard to have any privacy without going offline. (And really, it already is.)

This not only saves Google's business plan, it accelerates it. I'll bet Facebook is going to be all over this too.

Outta their minds,

[rhalstead]

What corporation in their right mind would put their data on some one el;se's servers? That opens it to government snooping as if it weere public data according to the administrations interpetation. It also removes it from their direct control.and it would need to be stored in duplicate at different sites, with archival backup. I coud never recommend that anyone store their data like that, let alone a coreporation. Like the power grid. It opens up many more avenues for failure and data compromise.