Hacker News Reader

Comment by m0nastic | Hacker News Reader

If you're referring to our VPN software, the version distributed by the vendor would crash upon initialization every time for a good year after Vista was released. I presume they eventually released a version that was stable, but my company had already decided to skip Vista by that point.

As to the applications which wouldn't work with XP SP2, WebInspect was a specific one (they eventually fixed it), but I recall there were a few others (basically any scanner that used raw sockets).

As to researching alternatives, I don't work in IT at my company, but if you're testing out a new version of the operating system that you deploy to all of your employees, and the VPN client doesn't work, you don't research alternative VPN solutions. You just decide to hold off on upgrading several hundred thousand systems until everything works.

View on HN

I'm afraid I don't understand; why don't you research alternatives? Is it a training thing?

there is huge difference between upgrading to new OS and [upgrading to new OS plus simultaneous replacement of the VPN solution company wide]

With Group Policy you can install a new VPN solution to everyone in your company at once. I think this has more to do with training (and IT having other priorities).

you obviously have a very limited view: if you're talking 10 or 20 machines, no problem. If you're talking 1000 or 2000 (or 10 or 20 thousand) then it's a whole different ballgame. Doing this would be career suicide. Imagine Monday morning, and half your upgrades cause people to have to change their way of doing things. Suddenly your HelpDesk is swamped. What do you tell your boss? Start off with a phased approach, IT first (the good IT people), then a couple of groups of power users. Allow them time to get aclimatized to it and you learn the sharp edges. Then gradually roll it out to the rest of your user population. Group policy is for changing all your backgrounds at once. But event then, you risk pissing off people in positions of power.

I don't think training has anything to do with it.

Rule number 1 for corporate IT: Keep operations going (i.e.: make sure everything works).

At some point you see that Microsoft is releasing a new version of their operating system:

  1.) You build some test images to see what the upgrade process would be like
  2.) You discover that your VPN client doesn't work with the new version, so you see if the vendor has an updated version that works.
  3.) It turns out that they don't, so you hold off with the upgrade until such time as they do.
  4.) Enough time goes by where to where you decide that it doesn't make sense at this point to bother with this version of the operating system, so you decide to just skip it (and when you ask around, it turns out a really large amount of other enterprises are doing the same thing).

The idea of replacing your existing (working) VPN solution enterprise-wide just to enable you to use a newer version of the operating system isn't something you seriously consider (as it goes against IT rule number 1).

Again, just asking, why wouldn't you do a limited deployment to your QA group to make sure everything works, and then do the company-wide deployment over a weekend after you know everything works.

I've worked at a programmer at companies where you weren't allowed to touch Widget X because it works, so I understand the mindset, but more often than not in programming departments the focus is on shipping so nothing is off the table completely. I guess I just don't understand why IT has a different mindset.

That's the point, they did a "limited deployment" and discovered that everything didn't work. Specifically, the VPN didn't work.

Making the VPN work would require spending millions of dollars in hardware, as well as the deployment of said new hardware in thousands of offices across the globe.

That's one option...The other option is to not upgrade to Windows Vista.

I don't understand what you mean by "mindset". The "mindset" of IT is to provide operational support. That means that they don't decide to upend the network infrastructure of the company willy-nilly for no discernible positive benefit.

> then do the company-wide deployment over a weekend after you know everything works.

Even if there weren't serious network infrastructure issues involved, I wouldn't dare do an OS rollout like this.

This isn't a new version of some webapp you can just upload to a server and be done with. You're talking about fundamentally altering the operation of thousands of desktops and laptops around the world being put to diverse use by people who are very probably not technically minded.

And it would be impractical at best to upgrade all of that over the network on a weekend. Every piece of hardware would have to be turned on and connected to a high-speed link with appropriate netboot infrastructure. That's not going to happen.

QA can't catch everything, so rolling it out all at once means the entire company goes apeshit on IT all at once. Watch the senior IT people walk out the door because they don't have to put up with the abuse and can find a new job. Watch the young and inexperienced IT people have nervous breakdowns and take months to address all the problems, possibly costing the company millions in the process...

Reply on news.ycombinator.com