Hacker News Reader

Comment by pcdoodle | Hacker News Reader

Good luck maintaining a fleet of this junk. Want to get your data from a non booting machine? Gotta break the screen! Batteries can't be replaced with breaking the screen either. Defiantly not a "business class" machine you can swap parts to keep your fleet going... Try fumbling around with one for more than an hour, garbage!

View on HN

How are you running a business fleet of machines and still relying on offline edge storage? Employees should be working directly out of networked storage, only needing an offline cache for the rare unconnected circumstance e.g. flight without WiFi. How many employees do you really have who a) worked on a flight AND b) broke their machine at the end of a flight, before they could sync, AND c) it would take less time to recover the data from a machine with better maintainability (remember: you don't know where the changes are to be found, and your employee doesn't remember) than it would to re-write from the last networked save?

For any non-trivially large fleet, you should a) be wiping the disk on a frequent basis so that users don't save work locally, b) have replacement "cattle" machines ready to go whenever an employee comes into the shop, rather than fixing the employee's "pet" machine and having the employee wait for the fix. It may be more expensive to run a Surface fleet, for the reasons you mention, but that doesn't mean it's not a business-class machine, it means that maybe Surface economics don't work out for your company.

On the flip side, they are tamper resistant. It would be incredibly difficult for someone to tamper with a Surface tablet siting in a hotel room without leaving marks. This is probably good for travel with a corporate device.

Do you really think anyone short of a state agency is going to break into your hotel room and attempt to install malicious hardware? Since I assume you'd have drive encryption in such a hostile environment?

Full disk encryption does not protect against hardware keyloggers, but obviously tampered hardware (broken screen) could lead to the user not entering the passphrase.

Also, this is not for my threat model, but it could be appropriate for certain corporate travelers or journalists.

With physical access, you could execute any number of attacks over usb to get access to data on the device.

That what BitLocker is for and Surfaces come with that thing enabled by default. (let's suppose you're not being targeted by NSA for simplicity of the discussion) =)

BitLocker doesn't matter if the device is on, and that the owner has picked a reasonably strong passphrase (people generally fail to do so).

Hence users who may be targeted should not leave the computer unattended AND powered-on. They need to set a TPM PIN and power down the computer when it's not being used.

BitLocker only allows you ten attempts to enter the TPM PIN, and if the bootloader is modified by an attacker, the TPM will refuse to release the key.

> TPM PIN

TIL

Also does it require it when comes from hibernation? Because by default Surface Pro powers off after certain time in connected standby, therefore if BitLocker pin is active after wake up the user is safe.

I believe it's required after hibernation (because the device is powered off), but not after sleep.

Is that any worse than a MacBook or an iPad? People manage to run huge enterprise deployments of those.

Windows is much worse than MacOS as general purpose OS and much worse than iOS for cases people are using iPads for. Hardware in Surfaces is fine.

Edit: I mean quality of Windows is much worse. It may have ingenious design internally but what user sees is just awful.

That is well and truly your opinion. I for one can't stand Mac OS but I won't go spouting that as fact for all users. Come on now...

I’m talking about quality, not the design or features. I can use both just fine since introduction of WSL. Quality and the way it updates kill the experience for me.

I agree that design or certain features can be very much personal preference thingy so I’m only discussing quality.

Reply on news.ycombinator.com