xahteiwi, (edited )
@xahteiwi@mastodon.social avatar

I'm curious, tech folk. What's keeping you or you company from running an any-device approach (including BYOD) with all corporate-mandated software (edit for clarity: I meant desktop applications) running in virtual desktops in the browser, with something like Apache Guacamole?

As in, what are the primary concerns?

(Feel free to boost, and/or add comments.)

RyunoKi,
@RyunoKi@layer8.space avatar

@xahteiwi That's a tie

xahteiwi,
@xahteiwi@mastodon.social avatar

@RyunoKi Pretty much, indeed. 🙂

pludikovsky,
@pludikovsky@chaos.social avatar

@xahteiwi Necessity. All of the mandated software works in the browser (chat, planning software, …). What's left is lightweight enough to run locally on pretty much any hardware and isn't really dependant on a certain version.

Compared to that, the lag experienced in full remote desktops through typical home networks for even basic development work was seens as more interrupting than the slower push/pull speeds.

xahteiwi,
@xahteiwi@mastodon.social avatar

@pludikovsky Okay, so you apparently don't have any real need for corporate-mandated desktop applications at all, great.

Does that mean that the company lets you use any device that has a browser? Or is there still some mandate that concerns "approved" end user devices?

pludikovsky,
@pludikovsky@chaos.social avatar

@xahteiwi So far it's been:
Pick Lenovo or Mac, budget is €XYZ, configure for your needs within that. Special hardware or licenses have to be cleared by your team lead or above depending on cost. Install this for VPN, that to chat, and we suggest a certain browser. If you're technical capable have fun with other configs but don't complain to us if it doesn't work.

pludikovsky,
@pludikovsky@chaos.social avatar

@xahteiwi Unfortunately, as we're being intergrated more into our big mother company, this will end this year. They've got a contract with an external company doing the whole support so it's 4 laptop models and only certain pre-approved software.

hikhvar,
@hikhvar@norden.social avatar

@xahteiwi as a developer: BYOD+Remote Desktop is IMHO the worst of both worlds.

I have to buy my own costly hardware. Until now the laptops bought by my employer where always more premium then what I own. Also I don't want to use private hardware for work.

Moreover, with remote desktop for company apps, I have to use an alien desktop environment. The main reason as a developer for BYOD is, I can use the environment I'm most familiar with.

If BYOD, make every corporate mandated app, a web app.

xahteiwi,
@xahteiwi@mastodon.social avatar

@hikhvar Consider that making every app a web app is precisely what Guacamole lets you do if you configure it that way.

hikhvar,
@hikhvar@norden.social avatar

@xahteiwi according to the Guacamole copy+paste is a huge mess. That are basics I expected to work reliable. My experience is, in a native web frontend this works much better.

xahteiwi,
@xahteiwi@mastodon.social avatar

@hikhvar Having solved this particular issue with my team in a (non-corporate-desktop) Guacamole application just this year, I can assert that copy & paste is by no means an insurmountable problem.

xahteiwi,
@xahteiwi@mastodon.social avatar

@hikhvar Just for clarity: I wrote any device, including BYOD.

Meaning company is happy to give you a device, but in the event that you don't like that device you don't have to jump through a bunch of hoops to get some other device approved, you can just use the one you prefer (as long as it has a browser).

jens,
@jens@social.finkhaeuser.de avatar

@xahteiwi Requires connectivity for the most basic functions, that's pretty much a no-go from the start.

A VM would make more sense. Something like SINA is perhaps over the top 😬

xahteiwi,
@xahteiwi@mastodon.social avatar

@jens

Hmm. Considering how many companies rely on interactive chat to do anything, I'd say permanent connectivity has now been accepted as a prerequisite to do any work at all. I don't quite see how having virtual desktops would make that bit any worse?

RyunoKi,
@RyunoKi@layer8.space avatar

@xahteiwi @jens Well, once you travel with train in Germany you quickly realise that expecting permanent connectivity is a bad idea.

xahteiwi,
@xahteiwi@mastodon.social avatar

@RyunoKi As is relying on chat or any synchronous work approach, yes. You may be preaching to the choir here. 🙂

@jens

jens,
@jens@social.finkhaeuser.de avatar

@xahteiwi Well, my wife works in KRITIS and has several scenarios where this is not acceptable.

I also review incident response procedures, and one of the critical questions there is how capable a team is to actually respond if their service infrastructure fails.

This may be fine for about 90% of cases or whatever, but it isn't for every job.

My personal opinion is that instead of accepting the 90% as normal, we should work towards making the 10% so easy to support it becomes normal.

xahteiwi,
@xahteiwi@mastodon.social avatar

@jens

Okay consider this: suppose in order to work you need a fully configured laptop, a working VPN, and some desktop applications. Now if your laptop fails to boot, you're completely out of action.

Suppose instead you need no specific end user device, and no VPN. All you need is a browser, a username/password, and a FIDO2 token. Now your laptop fails to boot, you grab any other device, fire up its browser, authenticate, and you're back on.

xahteiwi,
@xahteiwi@mastodon.social avatar

@jens

I am fully aware that there are now other implications to consider — as a random example, how do we defend against a key logger on the user's device.

But whether or not it's inherently more resilient to rely on a specific configuration of an end-user device, that I'm not so sure about.

jens,
@jens@social.finkhaeuser.de avatar

@xahteiwi That's how VMs work... and they only rely on the network when an image is first pulled.

That's more or less the principle behind https://www.secunet.com/en/loesungen/sina-workstation-s

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • DreamBathrooms
  • everett
  • osvaldo12
  • magazineikmin
  • thenastyranch
  • rosin
  • normalnudes
  • Youngstown
  • Durango
  • slotface
  • ngwrru68w68
  • kavyap
  • mdbf
  • InstantRegret
  • JUstTest
  • ethstaker
  • GTA5RPClips
  • tacticalgear
  • Leos
  • anitta
  • modclub
  • khanakhh
  • cubers
  • cisconetworking
  • megavids
  • provamag3
  • tester
  • lostlight
  • All magazines