Pleasing Google's Tech-Savvy Staff 142
An anonymous reader writes "Douglas Merrill, Google Inc.'s chief information officer, is charged with answering that question. His job is to give Google workers the technology they need, and to keep them safe — without imposing too many restrictions on how they do their job. So the 37-year-old has taken an unorthodox approach. Unlike many IT departments that try to control the technology their workers use, Mr. Merrill's group lets Google employees download software on their own, choose between several types of computers and operating systems, and use internal software built by the company's engineers. Lately, he has also spent time evangelizing to outside clients about Google's own enterprise-software products — such as Google Apps, an enterprise version of Google's Web-based services including e-mail, word processing and a calendar."
All Credit to Him (Score:5, Interesting)
Re:All Credit to Him (Score:5, Insightful)
The idea is not to restrict people, but restrict damaging elements from hopping around your network.
Re:All Credit to Him (Score:5, Interesting)
Even smart people can make errors of ignorance or naivetè with regards to their computers. It's nice that they've cordoned off the system to prevent them from torpedoing the whole network at once, but you still have a mess on the other side of the wall to clean up. Most of the important stuff is probably saved where they're regularly backed up(Google sure as hell isn't going to have problems with storage space) but there's definitely going to be downtime involved.
It's probably not worth the cost and risk for most companies. If someone wants or needs something on their system, just having them ask first is a reasonable approach.
Re: (Score:2, Interesting)
Exactly. IT security at most companies is designed around the belief that the average clueless user will find a way to screw something up if given too much freedom. So we lock them down in order to minimize the damage that they can do.
That's less of a problem with more technically inclined
Re: (Score:3, Interesting)
Re: (Score:2)
Oh, that's nice of you. You LET us developers do our job on equipment provided to us for that purpose. Thanx.
I'm being argumentative I real
Re: (Score:2)
For that matter, even IT workers can be pretty adept at shooting themselves in the foot. At a place I used to work, one IT staff member w
Re: (Score:2)
At the end of the day, it is all about a psychologists endeavouring to manipulate the greatest possible productivity out of the work force until they burn out. Google is a marketing company through and through, hence they use every marketing tactic availabl
Re: (Score:2)
Re: (Score:2)
The problem at that job was that we were sys admins in the ISP department. The company had a separate internal IT department to manage employee desktops, except for ours. We were free to install what we wanted, as long as it was properly licensed. The two sys admins who infected the network were Windows guys; most of the rest of us (including me) used Linux desktops. Interestingly enough, the laptop that caused the problem was issued by the internal IT department, a fact that I found gre
Re: (Score:2)
Re: (Score:2)
It's probably not worth the cost and risk for most companies. If someone wants or needs something on their system, just having them ask first is a reasonable approach.
No it isn't. You've just created a catch-22. How the hell is a user able to know whether an application is useful to them without installing and testing it?
I've worked in far too many places where people didn't install what would have been useful and productive software because it was just not worth the hassle. That by itself is an indic
Re: (Score:3, Insightful)
If you allow some employees access through those walls to other networks, and a hacker manages to get their credentials it can start to get quite nasty.
Even if the isolation between networks is good there's also the possibility of _work_ being secretly tampered with. I'm sure there are hacker who would want to tamper with GMail or Google Desktop.
Or confidential information leaking out.
Re: (Score:2)
Re: (Score:2)
Good luck with the IDS/IPS when your employees also use encryption (ssh,
Re: (Score:1)
I've had to do IT work for tech companies before, and it's like being the caterer at a chef's convention, they always think they could do it better. That he's managed to do it with a relative degree of success at a place as eclectic and high profile as google is impressive. I think the approach is novel too, although I'm not sure how well it would apply outside of their unique company culture.
The fact is: if you are the caterer at a chef's convention, probably (1) 80% of them would do it better than you and (2) the remaining 20% wouldn't, but they do think they would.
So, all credit to him for making them cook their own meals, which was more intelligent anyway and less reputation-damaging.
Nice approach (Score:3, Insightful)
Re:Nice approach (Score:5, Insightful)
I'm not really sure how that works.
Other than leaking source code onto the Internet, I don't really see what problems this could cause. I work at a small company with a similar philosophy -- the company buys your hardware, and certain software if you need it, but you can use whatever you want so long as you're not fighting with it on the clock.
But think about it: Spam botnets can be blocked by killing port 25 outbound. Data loss can be managed by the fact that everything's on version control, which is backed up. Traditional spyware and viruses will at worst take a machine down, at which point, it's the responsibility of whoever owns that machine to fix it -- or maybe they try to spread over the local network, at which point, staying patched and/or running a personal firewall will pretty much stop it.
The only real danger would be if we got big enough to be a target for deliberate attacks, and someone stole our source code. Google is arguably this big, but I've never heard of a leak from them. TFA does mention a possible strategy:
So what mistake could one employee make to ruin it for everyone?
Re: (Score:2, Insightful)
Re: (Score:3, Interesting)
Re: (Score:1)
[1]You can't accept a licence that makes you a slave, I think, or that says that you can be killed, of which I'm sure.
Re: (Score:2)
The first example, about monitoring all communications and tracking is pretty close to Google's own licenses.
The second example is close to one we ran into where the license said for non-commercial use only. The software's writer said he meant that to be interpreted as a personal computer at home, not a registered non-profit entity. We probably would have won if it had ever actually been adjudicated, but we just fou
Re: (Score:2)
Are you *sure* google would be bound to an agreement clicked-through by one of its employees? Sounds unlikely to me, but of course IANAL.
Re: (Score:2, Informative)
Yes. At least in Germany. Here, you, the purchaser, need to able to reed the EULA/ToS before even buying the software.
Re:Nice approach (Score:5, Funny)
Re: (Score:3, Interesting)
Re: (Score:3, Informative)
Show me how.
And traditional viruses/spyware won't do that.
The trouble is, modern OSes are reasonably secure at this point, and you can bet the external-facing IPs are going to be locked down. Same with internal services -- some random developer's desktop might be open, but the service is going to be secure. So what you're talking about is someone actively making a "hacking" attempt at
Re: (Score:1)
So what mistake could one employee make to ruin it for everyone?
Installing your entire warez collection on your work computer. Sure you'd get fired when you finally get caught, but if the BSA raids the company before you're found out it could be major fines the company is responsible for. Yes they could go after you in court for it to pass on the cost, but that's even more overhead dealing with the legal system. Even barring that, there's lots of ways to misplace license keys, and the BSA won't cut you any slack unless you've got damned good records.
Re: (Score:2)
Seems to me they could just as easily turn around and sue you for abuse of company property. I'm sure you signed an agreement with what you're legally allowed to do (or not do) with company equipment. And if it was your own equipment, it's even less their problem.
Re: (Score:3, Insightful)
Get pwn3d and:
a) Commit GMail/etc code secretly backdoored by a hacker.
b) Leak out the search ranking and antisearch spam methods/algorithm google uses. Google's search results are already not as good as they were years ago.
Re: (Score:3, Insightful)
b) I got nothin', though I'm willing to bet the search algorithm is one of those things that not many people get to see/tinker with.
Re: (Score:2)
That seems a bit absurd. Aside from code being reviewed on commit, or periodically, do you think they'd be able to actually deploy it to gmail.com without it being caught first? I really hope they're testing things separately and internally before making them live, even if it is a "beta" product.
Re: (Score:3, Interesting)
Data loss can be managed by the fact that everything's on version control, which is backed up. Traditional spyware and viruses will at worst take a machine down, at which point, it's the responsibility of whoever owns that machine to fix it -- or maybe they try to spread over the local network, at which point, staying patched and/or running a personal firewall will pretty much stop it.
That's a great theory, but more often than not, that *isn't* the way things really work. I've seen sys admins really bork config files that were using RCS. I've seen a virus take a network down for two days despite updated and running A/V and firewalls. Anyone who has worked in IT for very long is forced to admit that you can make it really, really difficult for your users to shoot themselves in the foot, but nothing you can do can guarantee security. The best firewall, the best anti-virus and the be
Re: (Score:2)
Re: (Score:2)
Only in an organization run by an IT staff that doesn't have a clue. In any other company, said employee would simply be put on a very short leash, or shown the door.
Not really... (Score:1)
It sounds like a superior approach, that probably will only work if you have a superior IT staff. So I'm not sure it is something that will scale to the rest of the industry.
NO TFA (Score:1)
Re: (Score:2, Informative)
Re: (Score:1)
http://online.wsj.com/article/SB120578961450043169.html?mod=googlenews_wsj [wsj.com]
Re: (Score:3, Funny)
I wish our IT was like this. (Score:5, Insightful)
I recently built an application for my group that started off in PHP/MySQL. The customers were using it and loving it, but IT said they're not interested in supporting PHP and we weren't allowed to stand up a server. After months of talk with them and compromising, it was rewritten into JSP/Oracle. Then they said we're not allowed to do that either, so we agreed on C#.net/MS SQL. I rewrote it to that and after a month, they again came back and said no way. Getting ever more frustrated (I now had the same program in several languages), I ended up in C# Desktop Application instead of web/MySQL. They've been complaining again, but we have more leverage there in that my entire group was stood up to build desktop apps. I'll probably have to switch it to Oracle, but that shouldn't be a big hit.
We wasted lots of time and money rewriting what was already done all because of politics. I always thought IT was meant to *support* rather than hinder.
Re: (Score:1, Insightful)
My view is that situations like this are what managers are for. They are there to traverse the politics for you to get your php application up because that's what needs to be done. They also have more leverage when talking to the IT department's manager, or when talking to the Department Manager that the IT manager probably reports to, which is good.
Re:I wish our IT was like this. (Score:5, Interesting)
Beware of any job where IT support calls the shots. That is an incredibly inane and inefficient business model. IT support is exactly that: They are there to support development efforts, not to hinder them with brain-damaged policies usually written and enforced by CTOs that don't have a clue and administered by low-paying drones who substitute authority for what they lack on the pay scale.
Why even bother working for a company like that? With the upswing in IT, you sound like you've got way more than enough experience to find a job elsewhere.
Re: (Score:2, Funny)
Why not switch to a company like google ?
Simple: they pay me so much money that this form of light torture / kafkaesque work environment is still more attractive to me. The banks I work for pay me approx 4 times more than google would - this way, I can retire when I'm 40 years old (and spend time doing interesting/creative IT stuff instead of having to be chained to a corporate entity).
I work t
Re: (Score:2)
Re: (Score:3, Interesting)
One large factor that keeps the war burning brightly is that the relative skills between various user communities and an administration community is also all over the map. I
Re: (Score:2)
My favorite MTA fun is a large insu
Re: (Score:2)
Re: the second para, using email as a message-passing interface. I've an example that backs up your first para.
I once created such a beast, horrible as it is, in concept. The data source was commercial software that couldn't emit anything but warning emails, and the demands upon the system I needed to create demonstrably wouldn't grow beyond a message count in the low hundreds in any 24-hour period.
S
Re: (Score:2)
Re: (Score:2)
OTOH, I wish CTOs who were also CS majors would post in a lot more places. For example http://www.theregister.co.uk/2008/03/20/motoring_offences_clampdown/ [theregister.co.uk]
has the math wrong. They forgot
I guess I just wish CTOs would encourage their people to post in public for
Re: (Score:3, Insightful)
If they're only willing to support a specific language, then you need to work in their requirement (generally speaking).
Re: (Score:2, Informative)
Re: (Score:2)
I agree with you in principle, but it sounds like in the original comment that there was no communication between IT and the developer in question.
Re: (Score:3, Informative)
My management did their best to fight it, but IT has a strong pull here I guess.
Re: (Score:2)
Re: (Score:2, Insightful)
IT is a cost, but if they are doing their jobs correctly they can also work to save the company money. Most software engineers have no clue about what technology would be best to implement their products on, they only know what got touted as the best/fastest/newest thing on
Generally, there's just too much ego involved fro
Re: (Score:2)
Re: (Score:2)
Are you qualified to know every tool that a user might want / need for every job, specifically software engineers? Do you know how they should be doing their job efficiently and so not be a bottleneck? I doubt it.
You're there to support your users not dictate to them. If you are qualified
Re: (Score:2)
B) Even if I WAS qualified to do every job in the organization not that many of them would be more highly compensated. Due to the multiplier effect of my efficiency gains I am more valuable to a company making lots of people productive then I am doing some singular job. As a wise man once said, pick up a nickel and you have a nickel, have 10,000 people pick up nickels for you and soon
Re: (Score:2)
- Initially, no - they wrote the thing in PHP just 'cause (maybe it was a prototype or maybe the devs were just experimenting and found they'd come up with something people wanted)
- In subsequent rewrites, yes - they agreed on C#, for instance, and then IT changed their mind after the thing was rewritten again in C#...
Comment removed (Score:4, Informative)
Re: (Score:2)
I call this the Principle of Least Work. If you have a department that has or can easily justify some form of authority over another (and any services-oriented department can do this by virtue of controlling access to the service, in this case IT services), without
Re: (Score:2)
To start off with IT is really helpful but then different departments start to abuse the IT department:
Generally the IT department starts off without any power and they do what they are told until something goes wrong:
Re: (Score:2)
What am I missing? You had discussions with IT and agreed on whatever platform. What happened when they said "no way", and you wav
Re: (Score:1, Insightful)
We wasted lots of time and money rewriting what was already done all because of politics. I always thought IT was meant to *support* rather than hinder.
Not if it's Microsoft. Then the 'IT' department is working against you. Sure you pay them, but their goal is to further the agenda of their political party. It's got stock and it files with the SEC but sure enough some kind a political party.
If they can't force you to toe Bill's line, they do their most to throw sand in your gears to see if you'll give up.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
And at that point I'd talk to my manager to talk to IT's manager. If nothing happened in a month go above him and explain the effect of IT's policy to the company's bottom line. If that then doesn't work - walk out and start your own company running your own servers with your PHP script. Obvio
Fringe Benefits? (Score:2)
What, do you get a free car every month? Free sex? Do you work at the Vatican?
These are about the only things that would motivate most people to put up with it.
The question is... (Score:2, Informative)
From the article:
Re: (Score:2)
This works remarkably well, but that's because our floor is about a 50/50 split of software developers and sysadmins, and we all know our way arou
Re: (Score:2)
Well, we usually don't have to install our own workstations--new employees usually get a machine that used to belong to someone who left. They can reinstall it if they want, but no one bothers. Engineering desktops are an eclectic mix of Debian, Ubuntu, and Fedora. The actual machines are usually old HP, Compaq, or Gateway PCs, but we also have several System76 boxen with preinstalled Ubuntu.
For engineers, we maintain our own desktops, though the company-iss
Re: (Score:2)
I think people *would* do that around here, except one of your last day tasks is to cause as much damage to the OS as possible, so that the next person has to reinstall
You should see people's faces when they realise there's no shell installed on their desktop anymore, and ps is doing funny things.
How? (Score:1, Insightful)
Re:How? (Score:5, Insightful)
Re:How? (Score:5, Insightful)
Mostly fluff (Score:5, Insightful)
It all comes down to this.... (Score:1)
So who writes these 'automated tools' and who checks those? I sure hope they have a human in the security audit mix somewhere....
Re: (Score:3, Informative)
Most likely they use those tools to check themselves, pretty much as you compile (most of) a compiler with itself, debug a debugger, and so on.
If you are interested in how these recursive tools work, check valgrind [valgrind.org]'s documentation (interesting because it relates a bit how some design decisions were made so that valgrind could be used on itself) for example.
Re: (Score:2)
Yeah, but then you become vulnerable to a checker that (by malevolent design) overlooks a security fault in both itself and other programs. Something like Ken Thompson's "Reflections on Trusting Trust" [wikipedia.org] in which the compiler inserts a backdoor into the login program, but also inserts the same code wheneve
Enterprise-software? (Score:2)
Is that a synonym for "software"? The sentence would seem to make sense then.
My company does this too! (Score:1)
I fail to see the "tech-savvyness" here... (Score:1)
Why would I work at a company that expects me to play the game with my hands tied behind my back?
As usual, another non-story about Google framed as an earth-moving event.
Not uncommon in tech-savvy organisations (Score:4, Insightful)
More than once I got hold of an oldish spare computer and installed Gentoo Linux on it, and the only justification I had for doing so was that Windows got on my nerves. Not much of a business case, but as far as they were concerned I was a big boy and could look after myself, and it was no skin off their nose as long as it didn't take up tech support's time.
The only thing that made us different from the tied-down masses elsewhere in the company was our level of knowledge about what we were working with. I maintain that the best security system is user education. Obviously that's not to suggest that you should throw caution to the wind, but clued-up people generally won't get you in trouble. So clue them up.
Right now I'm in a much more locked-down environment and it's incredibly frustrating. Something as simple as connecting to a printer is a nightmare because I have to go through some tech support clown who invariably knows a lot less than I do and bumbles around randomly prodding things till it works. I don't have admin rights to my own machine, and useful things like the command line are blocked. It drives me mad, and it holds me back in my work, but hey, some IT goon has an easier life because of it, so it's all fair enough, right?
Google is full of smart people, and the people in charge are clearly smart enough to treat them as such. I wish more companies would follow this example.
Re: (Score:3, Insightful)
Just because you have some brilliant techies doesn't mean they are all security conscious as well.
Re: (Score:2)
Re: (Score:2)
Once you've had to clean up the mess that someone else made of their computer because they didn't understand nearly as much as they thought they did, you start to realize why the rules are the way they are. But until you've been there, it's very, very easy to just assume that IT is on a power trip, t
Ehh. (Score:2)
standards-compliance (Score:3, Insightful)
Re: (Score:2)
Quick Story (Score:5, Interesting)
I moved from my job in NY as a System Admin for an ISP. I won't name names, but our major tech we used was Cisco, Solaris, Linux and VMware ESX.
My family and I moved to SC for the nicer weather
But I setup a few smallish vmware servers and I'm happy. I have my Linux-in-a-box. I've done a bunch of grepping and typing and scripting and such this morning, and I found some new issues that I didn't see before without seeing the "big picture".
So back to my point. I'm very picky about the apps I use and whatnot, so it's hard for me to "conform" to an IT ruleset about what can and cannot be run on company machines. The ISP I worked at was very flexible in this manner, for some reason I expect this out of the new job.
Our business model is we sell these published apps and hosting to our customers. We run a large private MPLS network and connect many smaller places to us. They can run Office 2007 from a website.
Then it hit me. Things have been getting really optimized in the last year or two, so we're using our own stuff. My office apps "live" in a website. The revelation came that now, when it comes to my laptop (or desktop), I can do whatever I want. Notice this is typically a nightmare for common IT shops, but many of our smaller customers think IT is a pain and will be happy with published apps and thinclients. For someone like me, who is tech-savvy, I can format my machine and install Linux (some of the other guys have already done so). Because there's a Citrix web client for Linux (I use it at home). Involve virtualization in the mix, and our datacenter becomes one giant network, one giant machine that we manage and the apps are just floating around inside. We manage all the security and whatnot, and keep it running.
So in a way, you really can have it both ways. We're not a Web 2.0 shop, but our method is definitely Another Way to Do It.
Last Adopter (Score:5, Insightful)
Re: (Score:2)
I work in the IT "automation" department of a company where I help support 30,000 desktops and 2,000 servers. Nearly 5,000 of our desktops now run a shell replacement that was designed only as a way to prevent a small number of machines from ever having access to their printer settings. Someone at the top liked it, and now our tiny widget is a desktop standard.
Re: (Score:2)
Re: (Score:2)
Outside of S
Re: (Score:2)
the best way to please a professional (Score:2)
Re:Not actually a big deal (Score:4, Interesting)
Re: (Score:2)
They are just doing things are are so weird, and so different, from anyone else, that their IT functions are more tightly coupled to the rest of the company than most places.
Re: (Score:2)