As Torvalds pointed out in 2019, is that while some major hardware vendors do sell Linux PCs – Dell, for example, with Ubuntu – none of them make it easy. There are also great specialist Linux PC vendors, such as System76, Germany’s TUXEDO Computers, and the UK-based Star Labs, but they tend to market to people who are already into Linux, not disgruntled Windows users. No, one big reason why Linux hasn’t taken off is that there are no major PC OEMs strongly backing it. To Torvalds, Chromebooks “are the path toward the desktop.”
Linux don’t need anything to challenge Windows. Windows is doing great on their own.
For gaming and home use I think Windows will slowly die off. But I see precious few enterprise customers who are willing to consider Linux desktops for anyone other than sysadmins or programmers. Some will allow Macs for general users but I’ve never seen one that allows Linux.
I’d try and get my work to switch, but apparently Zebra thermal printers (of which we have so many) don’t work well with CUPS, you may be able to do some weird shit to make them work but iirc it wasn’t too viable for a large scale operation.
I’d wager a lot of companies do use things that just don’t work too well on linux yet, not that they couldn’t work it’s just that none of the people smarter than me who make linux happen have worked on it yet, and until they do it’s just what it is. Before we want to capture the enterprise market we need good easy to use thermal printing software, CNC software, laser etching software, stuff like that. It can be done too for at least most things I’m sure.
Enterprise is where windows has deep claws embedded.
Hard to enforce a GPO on Linux, unless it’s locked down like ChromeOS.
That’s really the limiting factor: liability and support costs.
I think you can:
I’m not sure it’s much more work than what I’ve seen in corporate environments with Windows.
I’ve managed Linux desktop fleets in enterprise-like environments. I’ll modify your list a bit:
And as you have guessed, on Windows this requires a bit of point and click in SCCM to do decently.
On Linux, you’ll wanna start by getting a few really good sysadmins to write a bunch of Puppet for a year or so.
(If we include remote desktop capabilities in the discussion, I’ll do my yearly Wayland-rant.)
The other thing you’ll need is for compliance and risk management frameworks (e.g. CMMC, ISO27001, CIS, etc.) to fully embrace Linux controls and environments. As of right now, it’s a patchwork full of holes and if you need to demonstrate compliance, it’s likely to be a lot more challenging running Linux workstations.
that’s the difficult part of SecureBoot: you need to set up MOK and somehow sign the bootloader, kernel, modules with it.
but against small scale intrusions even the MS signed things could work
You need to have secure boot in order to have the disk decrypt without user input, otherwise the chain is untrusted. You can (and probably should) load your own keys into the firmware and sign everything yourself. MS has nothing to do with it, except that BitLocker is much better than anything any Linux distro has to offer today.
You need to have the disk decrypt without user input, and you can’t have the secret with the user. (As the user is untrusted - could be someone stealing the laptop.) The normal Linux user mantra of ”I own the machine” does not apply here. In this threat model, the corporation owns the machine, and in particular any information on it.
As for sudo, this is why we have polkit. (Yes, technically root, but you get my point)
And as for number 7 - this is why most Windows fleets use ”Software Center” or similar. No reason you can’t do the same on Linux, just that no one has done it yet. (I mean, you can, with pull requests into a puppet repo, but that’s not very user friendly)
Hate RHEL all you want, but first take a look at what distros have any kind of commercial support at all from software vendors. This is the complete list: RHEL, sometimes Rocky, sometimes Ubuntu. Go ask your vendor about Fedora Silverblue and see what happens. The primary reason to run Linux like this is usually to use a specific (and probably very expensive) software that works best on Linux, so distro choice is usually very limited to what that software vendor supports. (And when they say Linux, they are really saying ”the oldest still supported RHEL.)
Basically, corporate requirements go completely against the requirements of enthusiasts and power users. You don’t need Secure Boot to protect your machine from thieves, but a corporation needs Secure Boot to protect the machine from you.
It’s a piece of software with closed source code. I am aware that people can hide (and have done so many times) a backdoor or a mistake in source code so that it’ll be harder to find than many problems in binaries without source provided.
Still harder to audit.
Smart cards?
I know.
Sigh. Okay.
Look, I’m not saying BitLocker isn’t flawed. I’n m saying the alternatives on Linux are shit. All the primitives are there, and you can do it on Linux, with lots of work, testing and QC of all software updates on all your hardware (or else you’ll do manual entry of disaster recovery keys for the next decade). But on Windows it’s a checkbox to encrypt the entire fleet, along with management of recovery keys.
Also, on audits: for people doing checkbox security (i.e. most regulated industries), this is very easy to audit. You just smack in ”Bitlocker” and you are done. For some, the threat isn’t really information loss, it’s loss of compliance (and therefore revenue). Stupid, but here we are. If you mean actual security, then you are probably correct.
A smart cart only authenticates and identifies the user - it can’t do attestation of the boot chain. If we use a smart card for disk encryption, a malicious or compromised user can just pop out the SSD, mount and decrypt (using the smart card) on a separate machine and extract/modify data without a trace. If you use SB, the TPM and disk encryption as intended, you can trust both the user (via smart card) and the machine (probably via a Kerberos machine key). Basically, this method prevents the user from accessing or modifying data on their own machine.
Again, on Windows this is basic shit any Windows sysadmin can roll out easily following a youtube tutorial or something. Providing those same security controls on Linux will yield a world of pain.
We really need to make this easy on Linux. systemd-boot and UKIs are trying, but are not even close to enough.
I came here to say that too