Hell freezes over...

[bd139]

Believe me no one wants powershell on Linux. 90% of the windows admins I know don't want it on windows because it's a fucking pile of shit through and through. They're literally trying to blur the lines between the platforms here to maintain relevance. It's a total impedance mismatch. It's really like hooking people on their first dose of crack cocaine and then hoping they will come back for more because they are now dependent on it.

Anyone who has used powershell for windows automation knows that it's a fucking dirty great big minefield of pain once you get over the "ooh this is cool" phase. It's basically a fucked up object oriented bastardisation of Perl mixed with .Net but underneath the pile is still WMI and COM. Ultimately it's a stack of shit 100 levels deep that if anything even goes slightly awry it's game over for 2 days.

Example: Literally I spent two fucking days of my life a couple of weeks back trying to get Import-PfxCertificate to run over a WinRM connection to set up a signing certificate on local account on a build farm. Turned out that there was a KB article which required a registry frig to fix, an AD setting that needed to be changed in LSP, an account setting that needed to be changed and then it didn't work with the originally provisioned account so a new one had to be set up which required a bounce through the company's helpdesk to cover secpol. When that didn't work and MSFT support went "we don't know how to fix it", we actually logged in by hand to 30 boxes and deployed the certificates manually.

That is your life with powershell. Automation with it is a waste of time.

Don't use it on Linux. You don't need it. How do you solve the above problem on Linux? Stick a file in /etc/pki. Ansible's copy task does the job instantly. Bob=uncle.

Fucks sake. Good job I'm paid by the hour to handle this shit.

[Mr. Scram]

Believe me no one wants powershell on Linux. 90% of the windows admins I know don't want it on windows because it's a fucking pile of shit through and through. They're literally trying to blur the lines between the platforms here to maintain relevance. It's a total impedance mismatch. It's really like hooking people on their first dose of crack cocaine and then hoping they will come back for more because they are now dependent on it.

Anyone who has used powershell for windows automation knows that it's a fucking dirty great big minefield of pain once you get over the "ooh this is cool" phase. It's basically a fucked up object oriented bastardisation of Perl mixed with .Net but underneath the pile is still WMI and COM. Ultimately it's a stack of shit 100 levels deep that if anything even goes slightly awry it's game over for 2 days.

Example: Literally I spent two fucking days of my life a couple of weeks back trying to get Import-PfxCertificate to run over a WinRM connection to set up a signing certificate on local account on a build farm. Turned out that there was a KB article which required a registry frig to fix, an AD setting that needed to be changed in LSP, an account setting that needed to be changed and then it didn't work with the originally provisioned account so a new one had to be set up which required a bounce through the company's helpdesk to cover secpol. When that didn't work and MSFT support went "we don't know how to fix it", we actually logged in by hand to 30 boxes and deployed the certificates manually.

That is your life with powershell. Automation with it is a waste of time.

Don't use it on Linux. You don't need it. How do you solve the above problem on Linux? Stick a file in /etc/pki. Ansible's copy task does the job instantly. Bob=uncle.

Fucks sake. Good job I'm paid by the hour to handle this shit.

Powershell seems to be pretty well received in the admin world. It's a bit unfortunate Microsoft is pushing it at the cost of any and all GUIs, but it seems to work pretty well. It has to, of course.

[bd139]

I really doesn't work well. You need to use some of the non windows tools to see how bad it is.

We've got 1-2 people managing 400+ machine fleets with ansible for example.

Powershell / windows DSC team, similarly sized deployments are at 8-10 people and most of them are bogged down in weird edge cases and problems.

[Mr. Scram]

I really doesn't work well. You need to use some of the non windows tools to see how bad it is.

It is merely better than clickops.

Non Windows tools?

[bd139]

Updated post above to clarify.

To note I'm the platform decision maker here and we're shifting away from the human-centric windows admin world as a whole. It is very difficult to reliably automate windows.

[rrinker]

 Maybe you need to find some people that actually know PowerShell? I've done some pretty wild stuff, far beyond basic admin automation. The biggest complaint I had with PowerShell was the idiotic need to right-click, mark and paste, but Windows 10/Server 2016 fixed that and now you can do normal Control-C/Control-V copy paste stuff.
 The biggest problem people seem to have is treating it like a programming language (sometimes I fall into that trap myself) - it's not, it's a scripting language. There IS a difference.

[bd139]

I know powershell very well. I’ve written heaps of modules for it. So have the rest of our guys. We know it inside out. What you find when you take it to bits is a whole stack of nasty. When everything is working fine, wow amazing. But we have piles of problems which require taking the entire stack to bits from the top to the bottom due to the awfully strong coupling inside it and the sheer layers of legacy windows crap it wraps.

It’s a tangled mess of DCOM wrapped in a layer of shit and marketing.

What’s worse is that if you compare it to Linux for example is the documentation stops immediately beneath the powershell and it becomes MSFT internal magic then. Linux it’s manpages all the way down.

For ref, we use ISE as the shell. Comes with windows

[tggzzz]

What’s worse is that if you compare it to Linux for example is the documentation stops immediately beneath the powershell and it becomes MSFT internal magic then. Linux it’s manpages all the way down.

Are Microsoft still doing that?

I first ran into that kind of attitude in ~1999, when trying to script internet exploder. The docs/APIs implied one thing; in reality IE honoured half the API, and which half depended on what you were trying to do

As I tell people, I'm not clever enough to run Windows. Initially they laugh, then they realise why I say that.

[bd139]

Well it’s a bit iffy. Basically Microsoft were forced to open up their internals and provide documentation. These are nearly puked out here: https://msdn.microsoft.com/en-us/openspecifications/dn646765.aspx

But not a lot has changed from your 1999 assertion. Most of it is wrong, not documented at all or the API is terribly engineered or does something completely different to the documentation. And you find when you take the powershell modules to bits that they don’t all actually talk to documented APIs. And then there’s the NT Zw API for example which is a massive undocumented surface area. This pile of shit only becomes apparent when you have to delve into WinDbg territory.

I’m clever enough to take people’s money because I know how to run Windows marginally better than they do. That’s all I’m saying. Also when I’m doing MSFT stuff I get paid by the hour open ended only because I can’t actually give you an honest estimate up front on that side of things.

[Karel]

Microsoft is planning to bring its Defender antivirus to Linux systems this year.

https://www.zdnet.com/article/microsoft-defender-atp-is-coming-to-linux-in-2020/

[rdl]

Microsoft is planning to bring its Defender antivirus to Linux systems this year.

Good luck with that.

[Wilksey]

Bloody Azure, corporate lock in dictates we use Microsoft - including Azure, nothing but hassle.
Had to migrate from AWS to Azure, jesus, come back Amazon, all is forgiven.
Azure is constantly down with our dev ops team having to poke the Microsoft support to do something or other, we loose external IP addresses, we loose internal IP addresses between machines, the network setting somewhere in some Microsoft hub providing our VLAN or some shit goes tits up and we end up with connection errors and the fault screen of our monitoring system lighting up like a frigging Christmas tree.

Solution: You'd think move back to AWS, nope, re-utilise our 6+ year old servers in a data centre which are half dead, and not being used any more as too many power spikes have rendered them unstable.  Good - replace the PSU's? Nope, poke and hope.

Remember kiddies, cheaper ALWAYS = better! 

[bd139]

LOL AWS is a nightmare too. Had to dig someone out of a complete cascade failure because of a then undocumented set of limits in SQS last year.  .

[Wilksey]

bd139 - I'm afraid I don't share your experiences with AWS, we had instances running for a few years with no hassle no fuss, just churning away.

[Karel]

"Lenovo Brings Linux® Certification to ThinkPad and ThinkStation Workstation Portfolio,
Easing Deployment for Developers & Data Scientists"

https://news.lenovo.com/pressroom/press-releases/lenovo-brings-linux-certification-to-thinkpad-and-thinkstation-workstation-portfolio-easing-deployment-for-developers-data-scientists/

[Karel]

A look into CBL-Mariner, Microsoft’s internal Linux distribution

Yes, you read the title right. Hell is freezing because at Microsoft we have our own Linux distribution
called Mariner or more exactly CBL-Mariner where CBL stands for Common Base Linux.

https://blog.jreypo.io/2021/07/09/a-look-into-cbl-mariner-microsoft-internal-linux-distribution/

[duckduck]

What’s worse is that if you compare it to Linux for example is the documentation stops immediately beneath the powershell and it becomes MSFT internal magic then. Linux it’s manpages all the way down.

For ref, we use ISE as the shell. Comes with windows

This.

Good documentation at Microsoft is getting to be pretty scarce in the past decade. There are tons of "Here's how to get started" and "Follow these steps" and it is very difficult to find information on how things work in order to troubleshoot when things don't go all unicorns and rainbows. One ends up creating many experiments to try to figure out how things work. For Microsoft's SaaS offerings things get even worse. It seems that MS have made the strategic decision to offer no documentation whatsoever that covers how things work. I suspect that this has to do with the fact that MS would love to have you talk to a salesperson about their professional services, or sign up for a Premier Support contract.

With the Linux ecosystem, it can tend to be a little bit the opposite, but at least the information tends to be there. Additionally, there are many helpful greybeards, and you can always look at the source code if you care that much. Development is done in public, so the chances of talking to someone that can answer a hard question are much better.

EDIT:

Microsoft have had their own flavor of debian for years that they run on the SDN switches in their datacenters.

[bd139]

Indeed. We had some trouble last week because we're trying to auto-deprovision users from Azure AD and it turns out that the native API and GraphQL ones aren't logically consistent 

At the same time, let's tar and feather Amazon too. Their documentation is far worse and some of their stuff is completely broken. I was on a presentation the other day with some very senior AWS folk and managed to break their demonstration pretty badly.

The key metric for software is how the vendor reacts. Amazon had it fixed double-quick, within 48 hours. I've had to keep support cases open for nearly a decade with Microsoft who failed to issue anything past a registry hack.

With Linux it's much much much worse. It can be a complete minefield. If you look at the sheer amount of quality control work that goes into a Debian release you'll understand this. A lot of the upstream vendors are unresponsive or plain asshats. On top of that any problems that span an interface boundary between two applications (DBus is a good one) turns into a shit slinging match. I used to contribute patches to things but gave up around the time github started gaining in popularity as the public record for patch acceptance is pretty poor. Maybe a 25% hit rate on getting a merge. 75% of patches fall on silence, rejection or politics and I quite frankly don't give a shit about any of that these days.

[Mr. Scram]

Indeed. We had some trouble last week because we're trying to auto-deprovision users from Azure AD and it turns out that the native API and GraphQL ones aren't logically consistent 

At the same time, let's tar and feather Amazon too. Their documentation is far worse and some of their stuff is completely broken. I was on a presentation the other day with some very senior AWS folk and managed to break their demonstration pretty badly.

The key metric for software is how the vendor reacts. Amazon had it fixed double-quick, within 48 hours. I've had to keep support cases open for nearly a decade with Microsoft who failed to issue anything past a registry hack.

With Linux it's much much much worse. It can be a complete minefield. If you look at the sheer amount of quality control work that goes into a Debian release you'll understand this. A lot of the upstream vendors are unresponsive or plain asshats. On top of that any problems that span an interface boundary between two applications (DBus is a good one) turns into a shit slinging match. I used to contribute patches to things but gave up around the time github started gaining in popularity as the public record for patch acceptance is pretty poor. Maybe a 25% hit rate on getting a merge. 75% of patches fall on silence, rejection or politics and I quite frankly don't give a shit about any of that these days.

Asshats, egos and politics in the Linux sphere? I'm shocked.

[Karel]

Facebook, Google, Isovalent, Microsoft and Netflix Launch eBPF Foundation as Part of the Linux Foundation

https://www.linuxfoundation.org/press-release/facebook-google-isovalent-microsoft-and-netflix-launch-ebpf-foundation-as-part-of-the-linux-foundation/

[SiliconWizard]

Facebook, Google, Isovalent, Microsoft and Netflix Launch eBPF Foundation as Part of the Linux Foundation

Looks good.

[Karel]

Yes, it's happening, hell's frozen...

After years of calling the GPL a cancer, they start to distribute their own, GPL licensed, Linux distro:

https://www.phoronix.com/scan.php?page=news_item&px=CBL-Mariner-August-2021

[SL4P]

I remember years ago, the gubmint were trying to break MS into two groups.

My personal choice for that was -

• Operating Systems
• Business Applications (Office etc)
• Development / environment Tools (SQL, C# etc)
• Hardware (Keyboards, mice etc)

Other developments like phones etc would become completely new entities.

They could share IP, but would need to be done openly to encourage third party innovation.
In the US commercial environment, this is highly unlikely.

[bd139]

There is only one group now: cloud.

Even OS and Office are consumed by it.

Everything else is sidelined or on life support. I know a coupel of people who have quit recently.