I'm not saying it's horrible or you're wrong, just that there are situation where it's not always great. And right now Cloud is a magic keyword for PHB's, like virtualization technology and other things that had more hoopla and promise than were delivered on.

@Holocryptic although in 1 hour you can haz more

@Zypher But I wants it now!

I'm going to have to know what the actual limit is, so I can ration through the day

What is the limit?

Hehe...stars the limits...

I don't even know what to say to that

New rule of thumb...if it's been in a Dilbert cartoon, approach the technology with increased caution.

I agree that you can't say the cloud is good for everything - yet, I think it's coming. for instance in the case that you have phys servers and I have a cloud, if your server is dead you have to work on it to repair it. In the cloud (I'll use azure as an example) my worse case scenario is that the system my vm is on is dead and didn't auto restart it so I provision a new one in 5 mins

Virtualization has been. Has cloud computing?

But really, such awesome stuff is said in here that deserves stars. As such, we need more stars to hand out individually.

Or...I just migrate my VM's to the other VM server until I fix the server.

(I don't think Santa Zypher is giving out more stars unless you offer him some alcohol...)

heh

sure but now you are paying someone to manage what essesntially is a private cloud with your hardware - why not do the same thing on someone elses hardware?

That would be great, get zyph drunk and see what he does on the chat server with his mod powers. "I'll @% star you! Wheeee!"

Because I like my hardware's blinkies?

that's essesntially the message of vcloud from vmare and windows azure from microsoft (although azure is more app centric)

Dell's move to blue LED's makes the server rack seem so cool and futuristic...

Take away cloud computing, call it outsourcing, and what's the difference?

we still end up calling our provider for what we've outsourced to ask them what's happened to XYZ.

@JimB @BartSilverstrim There's trade offs inherent in either system. With physical hardware you have control of that hardware, and are not dependent on ISP links or the hoster going down. With the cloud, you reduce your management overhead, but have to rely on the hosters ability to stay up and a reliable ISP. To name a few.

because in outsourcing you are out of a job, with the cloud your still doing your job (assuming your job isn't staring at blinkies all day)

And by the way...sporcle, reddit, etc. are on the cloud...and Amazon is down. @#%

Hosting instead of outsourcing then.

But personally, I'm not a fan of the cloud in general. In practice it serves some purposes, but it's really being beaten to death as the next coming of Jesus or something. But it's not the end all solution to everything.

so as far as the network infrastructure goes, do you think that you have a more reliable connection to the internet then microsoft or amazon?

and I'm still trusting them to do something. I'm just saying there are people who don't like letting that control go. They like having their server in their datacenter.

At the moment?

I'm talking to you on chat. But I can't log into reddit.

:-p

@JimB If my DCs are (for whatever reason) hosted in the cloud, and I lose that connection, I am borked. If I have it here, I can still have reasonable productivity

Here's what convinced me the cloud is inevitable - all changes to computing (mainframes -> PC's -> vitualization -> cloud) came about due to the simple fact that it's more economical

He'll say not to cloud everything :-)

Mainframes had virtualization.

absolutely - but PCs were cheaper

Actually mainframes were better in some ways since you had workers on dumb terminals and centralized computing power and administration tasks in one place.

Dumb terminals are actually a bit cheaper.

And terminal clients were cheaper too.

We used PII's for quite some time using Windows Terminal Servers.

From what I gather, (and based on what we're trying to implement here) mainframe computing is making a comeback

User demands killed it for us.

thin and zero clients are coming up in schools now, with centralized servers pushing out VDIs

yup that's what multipoint server is designed to do

no...the future belongs to moving services to something like the cloud, and computers will become truly personal. That's my prediction.

We'll be in charge of access and infrastructure alone.

but I really think that in the next few years having a server in house will be the exception

The future, is the iPad!

Actually @zoredache, you're probably right in idea.

bah, you can keep your angry birds.

the future IS the ipad, and android and windows slate - any screen should get you your app

You guys ever hear of Corning Glass?

I am familiar with them

@Holocryptic, I don't really like Angry birds. PvZ is great though.

I live near them and have a friend working at the museum. I believe their gorilla glass is a component in iPhones.

@BartSilverstrim Corning Museum of Glass?

But take a look at this. youtube.com/watch?v=6Cf7IL_eZ38

@holo Yuppers.

I @#% love glass work.

The future of tech will be in pushing smartphones.

huh. I'll look at it at home. Speaking of, I need to jet. Laters.

Schools are trying to push iPads into classrooms. It doesn't work that way.

Watched that video and at one point thought, "Holy shit...iPhone 6."

the problem with the ipad is that it's not manageable, i know there is one school working on a windows tablet solution

No, not the problem. Ironic given that you just argued against our gripping on to control :-)

not managmeable how?

The problem is that we're trying to manage something designed to be personal

We don't manage cellphones. People use them individually. It's treated as theirs.

Same with iPads and iPhones and iPods...they're tied to limited accounts for downloads, sharing of content, etc.

@bart I never argued against keeping control ( I hoped I argued that the cloud can in many cases provide more control)

The key is to get these devices and technology to the students/employees to use as their own. subsidize them, make them personal and give them a personal stake in keeping them running and working rather than treat them as "I don't care because it's not mine ha ha ha."

if I want all the kids in my class to turn to page 33 in the ebook can you do that on the ipad? Not yet, but I can with multipoint and tablet PC

And you're not giving the control to them.

It's just another thing for them to abuse.

@JimB, that is just software. Someone could probably do that with an app.

They'd sooner die than give up their cellphones. And they're good at using them.

And why couldn't they all go to page 33? iBooks can't do that?

/confused

@BartSilverstrim, it sounds like he wants a way for the teacher to force every client to page 33.

Give them a cool device that they like using, and the only damage you'll see will come from dropping it in the toilet because they can't put the damn things down while taking a crap for ten minutes.

It sort of does, but that also kind of turns the device into just another extension of something forced on the students. And they aren't receptive to technology they can't control.

@zoredache it is just software that , right now, as far as I know only exists for windows, additionaly changing security for windows tablets is exactly like windows pcs.

Oh WTF, it's 20 past midnight, wherez mai starz?

What security do you need if they own it?

@BenPilbrow, reload your chat window? I think it doesn't roll over for another 40 minutes though.

I don't believe the servers to daylight savings.

@Zoredache duh thanks :-) Bloody DST :P

depends, I may not want peer to peer traffic, I may not allow certain websites etc

You block website traffic at your proxy.

Traffic flow can be monitored at the switches, and throttled.

Or on your AP controller

sure they own it but on school networks we'd have rules

Yes as covered with the proxy/switches.

And I hate to be the guy that gets drunk and pisses in the potted plant, but kids are already browsing porn from their cellphones while in school...they're getting "around" our network.

/mumbles "hotspot feature!"

Your access can monitor and limit things...but the personal (and almost universally accessible) technology/services are outstripping us now.

the same things you'd want security on if they brought their own PCs from home, or maybe you want to ensure encrypted network traffic

I mean, think of it...growing up with star trek, who didn't want a communicator? Now our cellphones are smaller than Kirk's communicator, and yet we still rely on intercoms to call kids to the office, despite nearly all of them having those damn phones virtually tattooed to their ass pockets.

What threats are there from home systems brought in that would need to be addressed? (and yes, I've been thinking about it.)

If B&N and Starbucks and McDonalds can offer access to anyone coming in off the street, why can't we?

@BartSilverstrim, depends on how your network is designed. Ideally you would put all 'guest' wireless clients on their own VLAN with a captive portal setup to force authentication. You want to prevent client devices from communicating with each other.

as an example I was a a company where their ipad kept locking out their account (and kept trying every 7 minutes) if it was a domain connected PC I could have managed it. it wa an ipad so all I could do was leave a voicemail and keep unlocking the account

Yuppers.

Why did it lock out their account?

bad password attempts

@JimB, why wouldn't your system blacklist the IP of the iPad after a few attempts?

So...the problem was they had the wrong password?

If it was a bad password why is it not a configuration issue to fix?

yeah they mistyped it, it is a configuration issue but since it's not a managed device I can't configure it - of course the user swore it wasn't the ipad.

Then it's not the ipad's fault, silly. They needed someone (or themselves) to change the password.

I can't manage users who lock out their accounts on the Windows PC's when they enter the wrong password.

oh that's the best part Zoredache, it did, and then the VP it belonged to threatend to fire the network admin for blacklisting his all important ipad

With a boss like that sounds like the net admin should polish his or her resume.

To be honest...

yes i believe he did

But you see my point?

I understand (believe me) the desire for management and control. We're just in a really bad place now...

yes but if this was a windows PC I could have taken care of it myself remotely

plus I really think the future is going to be more of us managing access to resources that may be "out there" while allowing technology to be "personal".

I trust Windows and Active Directory about as far as I trust what a stripper tells me.

@JimB, that isn't true. You could only do it if it was a Windows PC you had admin access too

and (to bring this back to the cloud) even if it was a personal PC as long as I regersted it with intune I can manage it

Sounds implementation specific.

I don't trust tying heavily to one particular vendor's implementation.

And being told it solves everything...I was sold that kool-aid with Netware.

Loved the server, but the client made me retch poo-flavored rainbows.

I think that we (as admins) are going to have to pick one since the only guys trying to play nice (IBM) aren't exactly going anywhere

You could always just require everyone with an iPad to let you jailbreak them. Then setup an SSH server and SSH keys.

iPads and the like are designed to tie to one person. I don't see it ever working well in a multiuser environment.

@zoredache, I could - or just tell them to use either android or windows based solutions

Like what schools are trying to do.

Android...bleh.

Windows...ha.

I agree with eh android bleh but it's an option

Or I'd just look at a solution that lets them access their data as they want, I just support and provide the access and infrastructure.

While Android is nice in theory, the various carrier restrictions on the phones makes it a real PITA.

B&N doesn't tell me I have to use a Dell laptop to get on the webbertubes.

The Android market is extremely fragmented...

As long as the device talks the protocol, it works.

That's what should be focused on.

In my opinion.

Let the user do what they want, I'll restrict and protect the servers and monitor at the switches and proxy.

And you know what? It will save us money and time, and users will like it because it's theirs. And we don't clean up the vandalism.

in all my examples I was using either company or school resources - both were examples of private data accessed by user owned devices.

They're already getting around things because the tech is getting personal, it's getting ubiquitous, it's getting cheaper.

We block facebook. But kids can get on it from their cellphones.

so if you care about them getting around proxies and such wouldn't you want to be able to stop them at the device level?

Not really. A lot of our blocking is mandated.

We can't stop them from browsing on their phones.

Not practical, solutions are illegal.

And if we control the device, we have to support it as well, and then you get the users vandalizing them because they don't care.

so if I understand you you'd like to control the devices but can't

We have kids that remove the batteries from phones when a teacher takes it so the teacher doesn't read the texts and such.

I only care about blocking kids from the perspective that is required to get funding... I don't care what people do on their own internet connection and own equipment.

Control is ingrained in me. I'm aspergian. But we can manage and control our networks, and advocate doing it at that level.

@Zoredache: and today, some internet connections are personal now...thanks to the cell companies.

You can watch YouTube videos from a device stuck in your pocket while walking along the mall.

I can skype my wife from my iPhone.

so if you could say that when connected to my network, you are off the carrier network would that be a good thing?

It's amazing what we can do.

@JimB: You mean force them to use the wireless network when in range?

@JimB, you mean like normal routing where you only have one default gateway?

maybe. But I don't trust it. And if it's theirs, I don't have the right to do that.

no I mean that if you do use the wireless, you would get kicked off the cellular APN

If it's their device, no. I don't believe in forcing that.

Because I don't pay for their device or support it.

ahh but you certainly DO have the right to do that as it's your network

No, I don't have the right to kick it off the cell network or reconfigure their stuff when used in adjunct to our resources.

do you let folks plug in their own wireless routers to your network- after all it's their device?

Their router isn't a personal technology device.

It's our building, but we don't restrict clothing beyond reasonable social standards.

Their wireless router would have to connect to a wired port which isn't designed for guest access.

And cell access is adjunct to our wireless access.

Our wireless network IS specifically designed with much stronger filtering polices and firewalling to permit guest access.

It doesn't interface directly to it or affect our equipment.

If they use our wireless network, they're filtered through that gateway. What they do with cell service is on their own billing and their parent's problem, as long as they're not showing "Booty Cum Blasters 3" to their classmates.

so having an open connection to the internet connected to your network via wireless doesn't affect your network security/

An open connection to the internet in our network?

You're suggesting routing cell data through our wireless?

Given my network design isn't any different from people being anywhere else on the Internet.

I can certianly turn an android phone into a router

You can turn it into a router for pc's to go out through the cell network...and you're paying the cell provider for it.

Or do you mean having it as an open router into your wireless?

In which case, it's just going to extend a network already designed for guest access.

So...they'd be kinda' wasting their battery power.

so you are saying that because someone else payed for the connection, it's ok to download and store a copy of "Booty Cum Blasters 3" on your network?

see where I am going with this?

No, not on our resources. But we'd segment the open network off.

@JimB, not at all. They are behind a captive portal, their usage was logged. If they abuse the network they will not be able to use it in the future.

Guest != anonymous.

They'd have access over wireless to google, youtube, whatever. But not to our file storage. OR they'd have access to particular home directories, where if we find booty cum blasters we'll copy it for our own use and then turn them in to the principal :-p

the usage came from the cellular side, how did you log that

If it came from the cellular side, then it wasn't on my network

See, here's where you're confusing me. You're saying they're going to route free access unfiltered to the internet, then put content into our network file servers?

There's still accountability if they can only access their home directories, or you segment it off completely so they can only store data on their devices and backups are their responsibility.

so the scenario I described was if I had a device on your network, via wireless, it's not managed you and it also has celluar access, this could be a tablet, a pc with a celluar modem whatever device you want

"Here's a network for you to use. Here are the rules of what you can and cannot do. Here's what you can access. Agree to the terms, have fun."

@JimB, but your scenario is meaningless.

that's what I was saying when I said "so if you could say that when connected to my network, you are off the carrier network would that be a good thing?"

you could have just as easily brought a flash drive in and connected it to a 'managed' device.

Sounds like you're talking about a vector for someone to put explicit content or malware form outside our network in.

That's kind of the reason we'd design that access to harden against it.

against it "attacking" our resources, that is.

but if I can manage a device , I can control what you use, I can control the ports the connections etc

we also can't prevent someone from bringing booty cum blasters on DVD either. :-)

@JimB, so?

You don't work in a school, do you? :-)

maybe he works in some high-security military location..

There is no way in hell we'd get away with those restrictions.

You might as well build a huge faraday gate around your building so they can't get Cell reception.

my original point was that I think managing devices is an important essential thing and that Ipads are bad candidates for environemnts with private data

We'd restrict it at first, then there'd be exceptions, then eventually it becomes pointless because there are so many edge cases that everything becomes an exception!

@Zoredache: and even then...it may be illegal to use that as it interferes with cell signals.

I understand your point, @Jim. I really do.

@JimB, I think your main point is only valid in very specific networks where high security is truely required.

I just don't see it being practical in our situation in the future.

The more we manage devices, the more pushback there is.

so I expect that very shortly both ipad and win phone 7 will have APIs that will allow you to turn off APN access when on a listed wirelesss SSID

The more headaches from edge cases where it doesn't quite work. (Damn AD still can't get printer drivers to deploy properly...)

I don't.

@JimB, are you sure the iPad doesn't already have that? Have you checked the admin kit?

I think Apple wants the i-things to be personal media devices.

it might I haven't looked at the admin kit in a while

There are lots of settings you can push onto devices that you actually control.

I think they have specific limitations if you try to use them for managed multiple users.

Apple's not interested in turning their devices into corporate toys.

They see it like cellphones...people taking technology along with them into the workplace.

The iPad is so locked down though, does it even work with multiple connections. I doubt there is any way to set up routes to prefer the Cell network. If you are connected to the Wifi, won't it completely stop using 3G by default?

@bart I'm not sure where apple wants to go with that marketspace, I think that the consumerization of IT will force them to provide corporate functionality or they will simply fade away since everyone else is either working on it or has it

Seems to, if you have it accept the wireless network.

Cuts down on your bills if you don't have unlimited data.