Comment on What the Linux desktop really needs to challenge Windows

• adespoton@lemmy.ca ⁨1⁩ ⁨day⁩ ago

  Hard to enforce a GPO on Linux, unless it’s locked down like ChromeOS.

  That’s really the limiting factor: liability and support costs.

  source

  • vacuumflower@lemmy.sdf.org ⁨1⁩ ⁨day⁩ ago

    I think you can:

    1. set up something like Fedora Silverblue,
    2. disallow root,
    3. disallow sysrq and such,
    4. allow sudo only for select few things,
    5. refresh configuration centrally.

    I’m not sure it’s much more work than what I’ve seen in corporate environments with Windows.

    source

    • enumerator4829@sh.itjust.works ⁨1⁩ ⁨day⁩ ago

      I’ve managed Linux desktop fleets in enterprise-like environments. I’ll modify your list a bit:

      1. Use Rocky or RHEL (because the commercial software you want to use only has support for RHEL and/or Ubuntu)
      2. disallow root completely without exception
      3. do additional hardening
      4. don’t allow sudo for fucking anything
      5. run centrally controlled configuration management (most likely Puppet)
      6. Ironically - disallow any use of Flatpak, Snap and AppImage. They don’t play that well with Kerberized NFS-mounted home directories, which you absofuckinglutely will be required to use. (Might have improved since I tried last time, but probably not. Kerberos and network mounted directories,home or otherwise, are usually a hard requirement.)
      7. Install and manage all software via configuration management (again, somewhat ironically, this works very well with RPMs and DEBs, but not with Flatpak/Snap/Appimage). Update religiously, but controlled (i.e. Snap is out).
      8. A full reprovision of everything fairly regularly.
      9. You most likely want TPM-based unlocking of your LUKS encrypted drives, with SecureBoot turned on. This is very fun to get working properly in a Linux environment, but super simple to do on Windows.

      And as you have guessed, on Windows this requires a bit of point and click in SCCM to do decently.

      On Linux, you’ll wanna start by getting a few really good sysadmins to write a bunch of Puppet for a year or so.

      (If we include remote desktop capabilities in the discussion, I’ll do my yearly Wayland-rant.)

      source

      • VirtuePacket@lemmy.zip ⁨1⁩ ⁨day⁩ ago

        The other thing you’ll need is for compliance and risk management frameworks (e.g. CMMC, ISO27001, CIS, etc.) to fully embrace Linux controls and environments. As of right now, it’s a patchwork full of holes and if you need to demonstrate compliance, it’s likely to be a lot more challenging running Linux workstations.

        source
      • vacuumflower@lemmy.sdf.org ⁨1⁩ ⁨day⁩ ago

        1. OK. I agree, but personally hate RHEL.
        2. Yes.
        3. Suppose so.
        4. Brightness and sound controls too?..
        5. Yep, meant that.
        6. I thought of something like company-issued laptops, which might be good to have functional without Internet connectivity sometimes, if it’s remote work.
        7. Dependent on the role some users might need to regularly install software you haven’t thought about.
        8. Yes.
        9. Well, disagree about SecureBoot, there’s nothing secure about MS signing your binaries. It’s just proof they are signed by MS. Setting TPM under Linux is, eh, something I’ve never done.

        source

        • -> View More Comments
• thermal_shock@lemmy.world ⁨1⁩ ⁨day⁩ ago

  Enterprise is where windows has deep claws embedded.

  source
• ArcaneSlime@lemmy.dbzer0.com ⁨1⁩ ⁨day⁩ ago

  I’d try and get my work to switch, but apparently Zebra thermal printers (of which we have so many) don’t work well with CUPS, you may be able to do some weird shit to make them work but iirc it wasn’t too viable for a large scale operation.

  I’d wager a lot of companies do use things that just don’t work too well on linux yet, not that they couldn’t work it’s just that none of the people smarter than me who make linux happen have worked on it yet, and until they do it’s just what it is. Before we want to capture the enterprise market we need good easy to use thermal printing software, CNC software, laser etching software, stuff like that. It can be done too for at least most things I’m sure.

  source