News for hackers. Stuff that matters.
Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by technofiend on Monday January 22, 2018 @11:04AM (#16205389)
The article specifically states "Provisioning Chromebooks for new employees is a minimal processing, taking no longer than 90 seconds worth of configuration settings." Other than the badly worded phrase "a minimal processing" I think you can reasonably assume you have your answer.

The article also mentions that "The model benefited the fact that all of Google’s internal applications are already on the Web". I'm just going to assume that means Google employees are using web-based remote access for development. If that's the case then their Chromebooks are really just expensive dumb terminals. We may differ on this but I personally don't see any reason to drop $1k+ on a dumb terminal just to say I own the hunk of plastic I do my job on every day, particularly when my employer will hand me one for free when I start my new job.

Based on that assumption I think you can also reasonably assume permissions around futzing with the needed browser plugins are limited and device compromise is handled how Chromebooks normally handle most problems: wipe and reinstall.

Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by ma2rten on Monday January 22, 2018 @11:11AM (#16205447)
You are reading too much into that sentence. Most software engineers at Google actually have a MacBook as laptop and a Linux workstation.
Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by jwlato on Monday January 22, 2018 @11:40AM (#16205695)
And that MacBook is primarily a web browser and/or really expensive dumb terminal.
Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by bonesss on Monday January 22, 2018 @12:05PM (#16205926)
Primarily... but then it's a MacBook for secondary uses.

You can't run minikube on a dumb terminal while off at a conference.

Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by technofiend on Monday January 22, 2018 @01:29PM (#16206634)
I guess the question really is can you download code from the repos to your own desktop or laptop and do anything with it?
Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by vrm on Monday January 22, 2018 @03:11PM (#16207473)
As far as I recall, you can download code to your desktop but not your laptop, unless you’re doing something like iOS development that would be difficult to do over say ssh -Y.
Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by bonesss on Tuesday January 23, 2018 @06:20PM (#16218851)
I'm not a googler, but from my readings about their dev culture: it wouldn't be practical, as such, for a lot of what that dev server is really used for. Stupid-much development, however, is API driven and based on isolated logic. Those individual components or spike solutions would make absolute sense on the laptop.

More importantly: with the kinds of operations Google is running these days you'd really expect lots of the APIs youd need for product development to be readily accessible.

So, yeah, you'd be hacking on your laptop separately, and maybe doing some kinds of work. They run a monorepo, though, so it'd be of a somewhat peripheral nature. Proper dev is what the dev station is for.

Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by ghostly_s on Monday January 22, 2018 @11:55AM (#16205838)
> If that's the case then their Chromebooks are really just expensive dumb terminals.

Your comment seems to be mostly a bunch of wild speculation, but if you are presupposing they use Chromebooks as dumb terminals, I don't know where you're getting this $1000 figure from. If that's were the use-case then there's no reason not to go with the cheapest Chromebooks available, which can be as low as $200.

Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by Chaebixi on Monday January 22, 2018 @12:21PM (#16206074)
I have no position on whether Google employees are essentially using dumb terminals or not but...

> if you are presupposing they use Chromebooks as dumb terminals, I don't know where you're getting this $1000 figure from. If that's were the use-case then there's no reason not to go with the cheapest Chromebooks available, which can be as low as $200.

That's wrong: A dumb terminal is basically a screen, a keyboard, and a network interface. A $200 Chromebook is going to have much lower quality versions of all three than a $1000 Chromebook. So, there is a very good reason why Google wouldn't issue "the cheapest Chromebooks available."

Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by technofiend on Monday January 22, 2018 @01:38PM (#16206701)
Because the Pixelbook is $1,000 and I figure that's the bottom end system you'd get from Google. But as others as have stated it is completely speculation on my part. All I have to go on is the mention of checking all apps were web-enabled as part of the migration. That implies people aren't just building a VPN from their desktop and then ssh'ing around after the migration to a private LAN which was also the point of the article.

So my original assumption was therefore must be using a web interface to some sort of unix desktop and then sshing from there, right? However on second thought the article implies once you're trusted you're trusted and all systems are enforcing their own security so maybe people are sitting on UNIX desktops at Starbucks, authenticating via a certificate and then trusted across the public interfaces of Google's assets. That too would make perfect sense and still fit the spirit of the article.

The question is really do you have trusted access from a portable device or simply via one?

Again this really is speculation on my part and I'll happily own that. I can only dream of the level of access the average Googler has; the regulatory oversight and internal interpretation of same has resulted in far harsher limits in my space.

Re:BeyondCorp: How Google Ditched VPNs for Remote Employee A... by technofiend on Monday January 22, 2018 @01:30PM (#16206645)
Totally wild speculation! And $1,000 comes me mentally mapping Chromebook to Pixelbook.