ESX's cost is a bit of a PITA-- theres essentials plus, but of course that lacks DRS; and theres the free version which truly is nice for a single-server solution... but there are a lot of good contenders out there for less.
Im not gonna say that the others are garbage; I took a peek at Xen and really like that they dont gouge you to death for basic things like "can manage several servers at once". Im just saying that from my experience, as well as from listening to others in the recent ArsTechnica discussion on virtualization, it really sounds like VMware is still on top-- as long as you can pay.
Disclaimer: I just got my VCP and regularly do a lot of work with ESXi.
The thing is, youll note that for the most part it isnt IT people saying "theres something wrong with BES; we need to move to IOS". Its that the employees over the last few years have gotten more leeway, and have started moving to entertainment devices with ActiveSync.
Im not convinced that RIM did something wrong by sticking to what it remains phenomenally good at, except that they did not see and react to this new phenomenon fast enough.
Blackberry could have survived as the business market's option. The security they once offered was unmatched.
IS unmatched. BES STILL has no real rival in terms of security; the second best uses SSL, which has widely reported problems and can be exploited by anyone with a root CA cert unless you take pains to remove all the default trusts from your devices. BES on the otherhand remains about as unhackable as you can be, using symetrical encryption with securely exchanged, privately held, per-device keys.
But now we even see RIM migrating away from what little they are good at by giving away their keys to oppressive governments in order to continue doing business in that country. RIM is feeding itself by cutting off its own appendages.
Youre buying into the ignorantly published FUD. RIM gave away BIS keys; they do not and never will have access to the BES keys. If you are a business operating on BIS, yea, android would be about 100x better since youre basically doing a ghetto version of POP over ActiveSync, and adding a zillion middlemen to the equation to boot. NOONE seriously considers BIS for business use; it has awful security, manageability, and reliability, and it is not the reason anyone chooses a blackberry.
I don't think Android is going to catch on in the business world.
Ill second that, but not for the reason you state. The issue is that the market is currently demanding media consumption devices, which Blackberries are generally terrible at; and theyre demanding touch devices, which Blackberries are latecommers to.
The problem is that neither of those criteria are really relevant to "business communicator", and I personally think "touchscreen" is mutually exclusive with "efficient at business communication" except in a few cases (like the Ill-fated Pre, which had an awesome interface and an awesome keyboard). I have an android-- Motorola Admiral-- and honestly I am not impressed. As slow as Blackberries could be at times, they NEVER missed a keystroke on the keyboard and I could ALWAYS initiate a phone call with 3 button presses without looking. My android does many things, but utterly fails with the hardware keyboard and initiating a call can be a frustrating experience if you dont devote your attention to the touchscreen.
Basically, Im part of a niche market that actually wants a business communicator and NOT a media consumption device, and that market is dying; but its still a market that RIM is king of.
Over the years, the far more likely scenario that Ive seen is that people do something they KNOW is a violation of some ToS or another, and then claim innocence to the broader community in some vain hope of getting their account back. This happens ALL the time in gaming communities, where a botter / hacker claims "it must have been my G15 keyboard" or "it must have been my use of Wine"-- until everyone finds out that no, you really are just a dirty cheater.
I mean, heres the mental calculus I use. There is basically no incentive that I can fathom for Google to go around randomly banning accounts on a struggling social network. If, on the other hand, the vocal plaintiffs DID do something grossly violating the ToS, they have a HUGE incentive to cause a stink about it in an attempt to get their account back. Not only that, history validates this as exceptionally likely.
Im not saying that Google ISNT randomly banning accounts-- but before I would believe it, Id need a rationale for WHY they would do so.
King of virtualization when it comes to things like "supports live migration of a VM's execution state and/or permenant storage", or "stability and speed of the networking layer".
I cant speak to KVM as my experience is limited to VMware, and some HyperV and XenServer testing. But just doing a check from RHEV's own fact sheet, there are a number of things that are missing that are quite useful: *Storage live migration *Hot add RAM, CPU *Hot add NICs, disk (note that RHEV has it wrong-- this does not require anything more than the free hypervisor, NOT enterprise plus as they claim) *Live VM Snapshots (not really clear how RHEV doesnt have this, even Virtualbox has this)
Those are all pretty core features-- to my mind, ESPECIALLY the disk and NIC hot add. There are a lot of times that it is an absolute blessing to be able to roll out a new VLAN on the network and to just hot-add a NIC to the firewall VM on that VLAN, and your network suffers no outage. With disk, its awfully nice to be able to add a USB disk to the VM without having to reboot the entire thing (again, how does HyperV and RHEV not have this?).
What you are describing is BIS. With B_E_S-- Blackberry Enterprise Server-- you run the server that is ultimately the endpoint for the blackberries. When you install the software, it creates its master encryption key; when you tie new devices into it, it uses that key to derive a per-device encryption key.
All data is sent thru RIM, yes-- but only after it has been encrypted by YOUR server with a key that RIM never gets a hold of. There isnt any question of RIM's goodwill here, but of their inability to crack 3DES or AES (depending on your settings), and their lack of knowledge of your keys. All RIM is doing is providing the transport, as you said-- they are not involved in the encryption process at all.
If you are asserting that you think that key gets leaked, be prepared to give some proof.
VMWare is pretty widely recognized as the king of virtualization-- at least so long as you arent concerned with money. Its overhead is far far smaller than the others especially when dealing with huge numbers of connections, and it simply has more features than its competitors.
Of course, that assumes you're willing to pony up for vRAM entitlements and Enterprise Plus.
Once again. For the last time.... RIM does NOT have the encryption keys used by BES servers. Those keys are held internally by businesses only, and those are then used (along with "random" data) to generate the device keys. Even if RIM somehow had the organization's master key, they wouldnt have access to the "random" data that was used to derive the device key (which is pulled from that "wiggle your mouse around for a while" procedure).
In other words, BES servers continue as unaffected as before. Call me when India figures out how to large-scale crack AES256 with unknown keys.
I hope you arent in a position where you advise anyone on IT.
Active Sync's security is in LARGE part dependent on the security of SSL. For a HUGE number of organizations, those SSL keys are self-signed, which provides about the same security of WEP. All that is needed to break in is to somehow get the device to reach out to your server, and then have your server present a similar self-signed cert. Even if you are using a "proper" cert, you can be "easily" bugged by a government, since a large number of governments are considered trusted root authorities (including China); this means they can generate their own certificate, claim to be your Exchange CAS, and your device will happily talk back and forth with it. Presumably at that point your device would authenticate to that rogue server; Im not clear in what form the credentials would be sent, but we're already into "danger" territory.
On the flip side, with a proper BES (which is NOT what is being discussed in TFA), SSL simply isnt in the loop. All communications are relayed through RIM, but the encryption keys (up to AES-256) are held completely internally. I believe (though I could be wrong) that each device has its own key which is derived from the master key, so under the absolute worst conditions someone could sieze a blackberry and -- shockingly-- have access to that user's email. But of course, they'd have to get around the in-memory encryption and flash encryption that a security-sensitive organization would obviously have enforced on their blackberries.
At the end of the day, if absolute security is a necessity, you probably dont want your employees running around with smartphones, but if you do, youre using Blackberry / BES because there STILL isnt a good competitor in that range. Plus, if we're completely honest, most androids are touchscreen, and touchscreen devices simply arent as good at fulfilling the role of business communication device. They have other perks, but from personal experience I can say that they are a massive letdown when it comes to email and phone.
Yet another slashdotter with a whopping 2 posts to their name, a 7-digit UID, no karma to speak of, who managed to land on the site right as this article was posting to drop some praise for MS. Hey look, you got the achievement "posted a comment" today, but Im sure this is an honest opinion, right? Just happened to be a positive comment about MS 60 seconds after an article on MS was submitted?
You all really do think we're stupid, huh? That we wont notice the EXACT SAME THING happening over and over?
Why didnt you manage to work any subtle jabs towards competitors in? Oh wait, you did, well done.
Your post started at moderation level 1, which combined with your high UID indicates that youve been on the site for all of about 15 minutes. If you had been on longer and actually garnered some karma-- like basically anyone who has been here in excess of 15 minutes-- you would start at +2.
Your post also appeared within about 25 seconds of the submission, and was a classic mix of praise for MS and jabs at Gmail, when pretty much everyone recognizes that gmail is and always has been far superior to hotmail in any of its incarnations.
Courts are currently considering whether it can compel Netflix to offer subtitles for ALL of its catalogue, with the justification that not doing so would be discrimination against the deaf.
You can argue the merits of that, but certainly these "compelled to provide service / good" situations DO happen.
Slashdot Mirror
Because we actually make it there.
Can it be done without ActiveSync? How are the policies managed and deployed?
ESX's cost is a bit of a PITA-- theres essentials plus, but of course that lacks DRS; and theres the free version which truly is nice for a single-server solution... but there are a lot of good contenders out there for less.
Im not gonna say that the others are garbage; I took a peek at Xen and really like that they dont gouge you to death for basic things like "can manage several servers at once". Im just saying that from my experience, as well as from listening to others in the recent ArsTechnica discussion on virtualization, it really sounds like VMware is still on top-- as long as you can pay.
Disclaimer: I just got my VCP and regularly do a lot of work with ESXi.
Karnov was nothing like Mario Bros, and TBQH was a better game.
The thing is, youll note that for the most part it isnt IT people saying "theres something wrong with BES; we need to move to IOS". Its that the employees over the last few years have gotten more leeway, and have started moving to entertainment devices with ActiveSync.
Im not convinced that RIM did something wrong by sticking to what it remains phenomenally good at, except that they did not see and react to this new phenomenon fast enough.
Does android have a way to restrict what apps can be put on it yet? Ditto question with IOS.
Honest question, Im a huge RIM fan but would love to know if ActiveSync can be similarly locked down as thats where people are headed.
Blackberry could have survived as the business market's option. The security they once offered was unmatched.
IS unmatched. BES STILL has no real rival in terms of security; the second best uses SSL, which has widely reported problems and can be exploited by anyone with a root CA cert unless you take pains to remove all the default trusts from your devices. BES on the otherhand remains about as unhackable as you can be, using symetrical encryption with securely exchanged, privately held, per-device keys.
But now we even see RIM migrating away from what little they are good at by giving away their keys to oppressive governments in order to continue doing business in that country. RIM is feeding itself by cutting off its own appendages.
Youre buying into the ignorantly published FUD. RIM gave away BIS keys; they do not and never will have access to the BES keys. If you are a business operating on BIS, yea, android would be about 100x better since youre basically doing a ghetto version of POP over ActiveSync, and adding a zillion middlemen to the equation to boot. NOONE seriously considers BIS for business use; it has awful security, manageability, and reliability, and it is not the reason anyone chooses a blackberry.
I don't think Android is going to catch on in the business world.
Ill second that, but not for the reason you state. The issue is that the market is currently demanding media consumption devices, which Blackberries are generally terrible at; and theyre demanding touch devices, which Blackberries are latecommers to.
The problem is that neither of those criteria are really relevant to "business communicator", and I personally think "touchscreen" is mutually exclusive with "efficient at business communication" except in a few cases (like the Ill-fated Pre, which had an awesome interface and an awesome keyboard). I have an android-- Motorola Admiral-- and honestly I am not impressed. As slow as Blackberries could be at times, they NEVER missed a keystroke on the keyboard and I could ALWAYS initiate a phone call with 3 button presses without looking. My android does many things, but utterly fails with the hardware keyboard and initiating a call can be a frustrating experience if you dont devote your attention to the touchscreen.
Basically, Im part of a niche market that actually wants a business communicator and NOT a media consumption device, and that market is dying; but its still a market that RIM is king of.
Over the years, the far more likely scenario that Ive seen is that people do something they KNOW is a violation of some ToS or another, and then claim innocence to the broader community in some vain hope of getting their account back. This happens ALL the time in gaming communities, where a botter / hacker claims "it must have been my G15 keyboard" or "it must have been my use of Wine"-- until everyone finds out that no, you really are just a dirty cheater.
I mean, heres the mental calculus I use. There is basically no incentive that I can fathom for Google to go around randomly banning accounts on a struggling social network. If, on the other hand, the vocal plaintiffs DID do something grossly violating the ToS, they have a HUGE incentive to cause a stink about it in an attempt to get their account back. Not only that, history validates this as exceptionally likely.
Im not saying that Google ISNT randomly banning accounts-- but before I would believe it, Id need a rationale for WHY they would do so.
King of virtualization when it comes to things like "supports live migration of a VM's execution state and/or permenant storage", or "stability and speed of the networking layer".
I cant speak to KVM as my experience is limited to VMware, and some HyperV and XenServer testing. But just doing a check from RHEV's own fact sheet, there are a number of things that are missing that are quite useful:
*Storage live migration
*Hot add RAM, CPU
*Hot add NICs, disk (note that RHEV has it wrong-- this does not require anything more than the free hypervisor, NOT enterprise plus as they claim)
*Live VM Snapshots (not really clear how RHEV doesnt have this, even Virtualbox has this)
Those are all pretty core features-- to my mind, ESPECIALLY the disk and NIC hot add. There are a lot of times that it is an absolute blessing to be able to roll out a new VLAN on the network and to just hot-add a NIC to the firewall VM on that VLAN, and your network suffers no outage. With disk, its awfully nice to be able to add a USB disk to the VM without having to reboot the entire thing (again, how does HyperV and RHEV not have this?).
My statement was based on (I think) the days of 4.x-- It is possible you are correct with regard to 5.0.
What you are describing is BIS. With B_E_S-- Blackberry Enterprise Server-- you run the server that is ultimately the endpoint for the blackberries. When you install the software, it creates its master encryption key; when you tie new devices into it, it uses that key to derive a per-device encryption key.
All data is sent thru RIM, yes-- but only after it has been encrypted by YOUR server with a key that RIM never gets a hold of. There isnt any question of RIM's goodwill here, but of their inability to crack 3DES or AES (depending on your settings), and their lack of knowledge of your keys. All RIM is doing is providing the transport, as you said-- they are not involved in the encryption process at all.
If you are asserting that you think that key gets leaked, be prepared to give some proof.
VMWare is pretty widely recognized as the king of virtualization-- at least so long as you arent concerned with money. Its overhead is far far smaller than the others especially when dealing with huge numbers of connections, and it simply has more features than its competitors.
Of course, that assumes you're willing to pony up for vRAM entitlements and Enterprise Plus.
Hook some 3g routers up to batteries and tie them to cats. Set the cats free and grab some popcorn.
Which is why its a good thing that BES doesnt use SSL certs.
Note that BES servers by default use 3DES and (i think?) MD5, but can with the click of a button be transitioned to AES / SHA.
Once again. For the last time....
RIM does NOT have the encryption keys used by BES servers. Those keys are held internally by businesses only, and those are then used (along with "random" data) to generate the device keys. Even if RIM somehow had the organization's master key, they wouldnt have access to the "random" data that was used to derive the device key (which is pulled from that "wiggle your mouse around for a while" procedure).
In other words, BES servers continue as unaffected as before. Call me when India figures out how to large-scale crack AES256 with unknown keys.
PS, if you think IMAP is a serious competitor to what a BES does, you are even more in the dark than I originally thought.
I hope you arent in a position where you advise anyone on IT.
Active Sync's security is in LARGE part dependent on the security of SSL. For a HUGE number of organizations, those SSL keys are self-signed, which provides about the same security of WEP. All that is needed to break in is to somehow get the device to reach out to your server, and then have your server present a similar self-signed cert. Even if you are using a "proper" cert, you can be "easily" bugged by a government, since a large number of governments are considered trusted root authorities (including China); this means they can generate their own certificate, claim to be your Exchange CAS, and your device will happily talk back and forth with it. Presumably at that point your device would authenticate to that rogue server; Im not clear in what form the credentials would be sent, but we're already into "danger" territory.
On the flip side, with a proper BES (which is NOT what is being discussed in TFA), SSL simply isnt in the loop. All communications are relayed through RIM, but the encryption keys (up to AES-256) are held completely internally. I believe (though I could be wrong) that each device has its own key which is derived from the master key, so under the absolute worst conditions someone could sieze a blackberry and -- shockingly-- have access to that user's email. But of course, they'd have to get around the in-memory encryption and flash encryption that a security-sensitive organization would obviously have enforced on their blackberries.
At the end of the day, if absolute security is a necessity, you probably dont want your employees running around with smartphones, but if you do, youre using Blackberry / BES because there STILL isnt a good competitor in that range. Plus, if we're completely honest, most androids are touchscreen, and touchscreen devices simply arent as good at fulfilling the role of business communication device. They have other perks, but from personal experience I can say that they are a massive letdown when it comes to email and phone.
Yet another slashdotter with a whopping 2 posts to their name, a 7-digit UID, no karma to speak of, who managed to land on the site right as this article was posting to drop some praise for MS. Hey look, you got the achievement "posted a comment" today, but Im sure this is an honest opinion, right? Just happened to be a positive comment about MS 60 seconds after an article on MS was submitted?
You all really do think we're stupid, huh? That we wont notice the EXACT SAME THING happening over and over?
Why didnt you manage to work any subtle jabs towards competitors in? Oh wait, you did, well done.
For the record, for all to see-- lest anyone think that shills arent real.
H105's profile:
2 posts, and the following achievements:
(0) Days Read in a Row 2012-08-01
Posted a Comment 2012-07-31
Had a Comment Modded Up 2012-07-31
Yea dude, you joined today and posted 30 seconds after this article was posted, but its totally not a paid opinion!
Your post started at moderation level 1, which combined with your high UID indicates that youve been on the site for all of about 15 minutes. If you had been on longer and actually garnered some karma-- like basically anyone who has been here in excess of 15 minutes-- you would start at +2.
Your post also appeared within about 25 seconds of the submission, and was a classic mix of praise for MS and jabs at Gmail, when pretty much everyone recognizes that gmail is and always has been far superior to hotmail in any of its incarnations.
Seriously, how dumb do you think we are?
Obvious shill is obvious. Why dont you and faraway do us a favor and remove yourselves from the site?
Is slashdot's reputation really that low that companies dont think we'll see through such a blatant attempt?
Publicly traded isnt the same as publicly owned. The ownership is still "private" in that it is not a government entity.
Courts are currently considering whether it can compel Netflix to offer subtitles for ALL of its catalogue, with the justification that not doing so would be discrimination against the deaf.
You can argue the merits of that, but certainly these "compelled to provide service / good" situations DO happen.
GP WAS saying that "there oughta be a law", which is what is being objected to here.
Try and stay on top of the discussion.