Building a company without Google Workspace

Transcript

[music] [music] Okay. Hello everyone. Uh I have to say it was pretty tough and probably toughest thing on this transition was uh Google slides because I had a talk on the fire security summit and there you were actually first forced to use Google slides. So I have to take PDF presentation, use my agent to turn it into Microsoft Office presentation and then upload it to Google Drive to compress it to Google Slides and present the compressed version to be able actually to present something. But today I can be on my

laptop. So uh it is in pure quality uh as uh it was initially created. So uh we are ACK free security company and we were deciding uh that we could uh get rid of the Google and uh use something what will be more privacy oriented and this talk will be uh about our journey so far. So the default is usually to Google and it's making the things easy. You have integrated work you have sold mail, calendars, files

like everything, meetings which are working very nice. People are uh used to use that. So uh everything is nice and it's easy to collaborate. you have a nice documents. Uh comment section group management is especially good. You can create several aliases uh and uh uh assign uh in your company to specific divisions.

And uh probably the biggest thing there is Google single sign on where you have uh easy access to most of the services where you can just login with one click. So is there currently anyone who is using Google in his company like I see pretty a lot. So let's see if we can move from it. So uh the reason for the change uh I think privacy uh should be like a company default like and uh uh our choice in in the company like affects also others. So

uh when you are uh when you have your employees and some contractors basically when you have uh let's say Google meeting with them then you force them to use the Google stack and so on. So uh it is important that uh it's uh not just about you and since security is our business uh the privacy is also important like uh end to end encryption brings you privacy but it also gives you some better security guarantees. So sometimes privacy also strengthens the security principles but also we wanted to keep somehow the comfort what Google provides us because I think uh the comfort that Google

provides is basically uh the main reason why people are used to that and then what is comfortable to stay managed Because if you want to self-host uh you can like uh today selfhost very very easily uh with AI but uh as you can see uh each day there are more and more hack services like two days ago it were even freezers uh uh and these u things there there's like a lot of things that needs to be patched every day and if you don't have a dedicated team for that uh then uh you can spend a lot of I'm just

uh patching your own infrastructure and uh it's obvious that when you will be for example using Google then they have a big dedicated team for the security of the product you are using and uh so it's uh uh we rather wanted to outsource this work but but when you start deciding uh like uh which way you will go. It's important to think about the threat model you have like what you want to protect from one and at what cost.

So uh I know like before this talk I was for example speaking with uh people from Ethereum foundation and they definitely need like uh uh they have uh they need more uh like sovereignity guarantees than uh some uh for example cloud proh providers can provide because there is a higher chance of some uh state pressure or jurisdiction. Uh so when you need uh the resilience first then you may need to sell host but it also means that you will need a uh dedicated team a regular regular audits for it.

For our case where we mostly want to secure uh just our clients and we want to outsource the security for our own infra. We decided to go by a little trade-off and we also think that in our position we have like a low chance that uh there will be some targeted shutdown risk and in any case it's always important to have independent backups like you know that on on your GitHub you can have a your organization which you are stacking up there data for let's say for years but what will you do when the GitHub hub

will go down, you will lose all the data. So, uh it's important to have the backups and also test it the restores for your data in company. So, how to replace the tools but keep up the pace with the work. So, this is not the complete list. Uh it's just uh u picture so you can see that there is more than one way out. uh lot of services uh for mails do uh docs, passwords, meetings or identities.

Uh when we were choosing uh which way we will go, we also wanted to have the service which can cover most of them similarly like Google. Uh so less the services the better for us. Uh one service which we uh decided to use is not there and it's the proton. It's this year came up with uh meats and a workspace I think this year and uh because of that we decided to just try it out how it could work. uh because like the meats I think was the latest thing which we wanted to

have managed and somehow well working and let's describe the experience. So starting with mail uh I think it's nice you just keep the domain and uh go to the new provider. uh they they email I'm just using it I think since the be beginning when they started and it works like very nice uh so uh this is just with UIX aliases there work very nice nice mail and calendar everything good also it has a built-in calendarly but there are also some downsides

one which is very weird for company when you have a company group invites uh then you will get the invite only into email and it does not reflect into calendar. So uh when you are inviting through aliases then uh easily someone can just miss that there is some global event uh for let's say company alias or for some selected group of people and uh if you won't click uh that you attend some event in the calendar or not then it will not create a calendar entry so again you can easily miss something have to say that uh the eosystem them there is evolving very fast and I think

they are open to uh feature requests. So these things which I am uh highlighting as a downsides they may be fixed in the future or you can uh probably choose the right behavior. But uh since we were pretty early in this product uh this is for example how the invitation mail looks like like it was like very cryptic and when you send something like this to to your client in doesn't need to be like look like very professional.

So it was pretty weird but u like after 3 months I think they fixed it and these weird lines are just uh away. [snorts] Uh then drive and docs I think it just works. Uh we don't use it that much but from what we needed it it was working. But what is extremely weird there is no uh button how to export like PDF [snorts] from the document let's say uh and then what is a little bit problematic that there is like no documented API so not really great for some agentic approaches.

So this is how looks the export to PDF. It basically you will get this popup and then you will save the document as PDF like like you are saving PDF from the browser. So it looks like very weird. Then what is really great is uh that it has in the workspace built-in password manager which uh so far from the experience is a very good product and uh it has also maintained CLI integration which you can nicely use for some agendic work and you can create their vault vaults per uh the groups what you created. So you can have a uh walls with

secrets for specific division in the companies for specific arranges of people and it's like very nicely manageable. Uh this is the repository there are just commits like uh every day and the meetings which was pretty surprised that it was like um better than we expected. Uh the blur feature uh was uh initially a little bit weird. It also blurred half of your face. So you had in the video just your nose or something like that. But uh later they fixed that. So now it's like very usable. Uh and also added emoji actions.

There is a chat. Uh we've never encountered some problems with uh screen sharing. And uh but what is more important [clears throat] probably the most important is uh when we shared uh the link for the meet to some clients we did not tell them that uh we just changed uh uh the meeting uh software but they just uh joined. So uh uh we have zero issues with client joining this. They just trust it. So uh that's probably the most important thing.

uh and it has also uh native applications but I don't really use them but it has also some downsides uh well the first is that uh mi dashboard uh when when when you create the call then you see uh similarly like on the Google mid dashboard which meets you uh you have next but when you are invited to the call then you don't see it. So, it's a little bit confusing. And what is the worst thing there is that the leaving call is really bad.

when I mean bad that uh some sometimes it takes two clicks to leave the call and sometimes it takes three clicks to uh to leave a call and uh uh when you are just trying to exit the call and you still are getting some pop-up windows then it ends up that when the meeting ends you just see all the people that uh that are silent and trying to leave the call. Uh so it creates a little bit weird situations. Uh but um I was also trying to uh uh bypass it by creating a special extension which will just uh turn some JavaScript to exit it for me.

But they are doing micro releases. So I will need always to change also the logic of my extension uh to exit in one click. So uh this is really terrible. Then from user groups perspective uh this is like very nice uh uh some of the latest changes was that they also added more admin roles. So you can have a admin for organization user and security admin. So it is also convenient and that's it basically.

So uh what is important here uh what we did not mention uh how uh basically uh our solved the proton uh proton Google single sign on uh proton does not have it anyhow implemented natively similar like Google but it allows you to use your own provider for that. So they provide you email and all the related services but you can still use uh some identity provider alongside and this identity provider can be potentially uh self-hosted. So you can use for example octa authentic or key cloak and

alongside a proton and this way uh you could have the feature you get also from the Google But it's important to decide whether you really need it or not because uh it's usually the most important question how you need it is uh how looks your onboarding kind of boarding process if you need to rotate secrets for which services like look what services you are using and based on that decide uh what is your priority and if it's worthy for you uh to uh connect to such identity provider solution and I'm getting a little bit out of

time. So to somehow sum up it uh it uh added no extra management uh overhead for us. It was uh there were also no uptime issues. It has a really good UX. Uh we didn't encounter uh anything also with externally users. It has a still quick roll out of new features. What is uh uh downside there is uh since uh it is more privacy oriented and there are bigger security guarantees, it also uh is somehow more limited in integration perspective. Something like if you will be working with some bank app or

something like that. But uh you can uh uh [sighs] you can solve it uh other ways. uh what was funny when I was creating this talk that uh uh there was actually failure of Google cloud and it also shut down revolute so it's also showing that these uh big players are not having such resiliency in current age and uh also uh revel for example for us said no to open a bank account so we started using uh h I heaven heaven we are seeing it [snorts] and uh it's a pretty

interesting service where it's built on the privy uh base chain and uh somehow collaborates with near intents from what I heard and it basically gives you uh uh off-ramp for fiat so you can accept stable coin payments and go to fiat very nice service recommend you to check it out and also what I needed to add to this talk because everyone asks us for that what is the notion alternative because when you you are usually using Google and notion to it. So we definitely recommend file virus but uh essentially we just figured out uh after a while when we were using it that uh we just use for everything GitHub. So uh today with AI you can like

build lot of microservices and uh software or uh edit some open source software uh which you found uh to suit your needs. And this is for example uh how this presentation was created. It was using MARP and for marketing videos we are for example using Manm. So, so far where we had uh several uh external services on subscriptions you were paying, we were able to shrink it very uh uh to low number of services we now depend on which is pretty cool and it it will not be possible like a year ago.

But uh we did not talk yet about Google console, Google cloud and uh I have their job to come up on stage to talk about it. >> Thank you. >> Thank you. It will be very quick. So infrastructure that's of course something that uh Google uh does pretty well. But uh our way was to find out if we can do it without Google. So there are these plenty of options. Uh what we needed was to create some kind of like because we are security guys at SDK3 and we needed to create some like

orchestrated uh cloud-based uh service for cyber security defense and this needs to run a lot of containers in parallel with custom uh agents in that and it has to be orchestrated. So it's like typical uh work for the clouds and we wanted something that it's cloud native and can be vioded very easily. Uh so what we selected is these guys Cloudflare maybe you could tell Cloudflare that's some kind of proxy for DNS. So not anymore they have built a whole cloud native stack around their uh solution and it works actually pretty well. So these are all the services that

cloud for offers. Uh no time to go one after another but basically everything we needed from manage databases to storage to deployment everything is there and we created kind of like platform for token maxing security and everything runs on cloud for very smooth. Uh it's called swarm and how did it uh the experience how was it? The biggest advantage is that there is no tech dep. So basically they are not dragging any Kubernetes or stuff like that with the CLI tools. So it's very easy to manage and it's fully agentic which means there's an MCP server that knows the configurations. So basically if you tell your agent, hey

develop this on Cloudflare, it probably knows to do it better than you. So it was very easy to develop on that. And uh what didn't work that well for example some niche features like versioning of your deployments uh it was not there when I was uh creating the presentation or there is not that um fine u grain uh access policy as on GCP or AWS but overall you're able to create pretty huge application with that and uh it runs uh it runs very smooth so yeah it's not about uh telling that Google is wrong. Of course, we are happy that Google has built a lot of uh useful stuff, but we just wanted to show that

there are also uh alternatives, right? >> Yeah. Thank you. >> Amazing. Thank you so much. Uh now we're going to begin our Q&A sessions. We've got some questions and um can we start from the first one? How come there's no GitHub alternative you guys prefer? >> What does it mean no GitHub alternative? Uh you mean like GitLab or something like that? I think uh it depends what you need. If uh you for example building open source repositories where you want to have also community then it's same

like uh like uh social networks because uh you want to talk on X where where are people and it's same on GitHub. So when you want to create uh pull requests have discussions then GitHub is probably only place uh when you need it just for internal purposes then uh you can uh uh probably run also on g on gitlab I think uh it's uh nice to uh use potentially both products you can uh have a mirror to gitlab and use both so you will uh get u uh u most of And um Ysef do you also have NASA or shall we move on to

>> May maybe just comment like we we didn't want to make our life harder. We just wanted to keep some kind of standard that we are we are used to uh and via GitHub works for us pretty well. >> All right. And the next question would be the this one. Even in decentralized alternatives, don't we risk creating new forms of centralization? Deep question like yeah dependence on a particular platform or service provider. How this fundamentally differ >> maybe first of all like we are not using decentralized alternatives that much.

Proton is not decentralized. Cloudfare is not as well. So this was not like decentralization maxing effort. It was more like vendor lock out from the major provider that basically would control everything which we didn't want. >> Yeah. Right. Like uh we just wanted to uh give a little bit of that cake Google is eating to some other service like you know you have for example Ethereum node. So don't everyone doesn't need to use get someone can use also the other ones right? So uh it's uh uh I think it's somehow helping to little decrease the centralization when you just change the

provider even to his uh infrastructure is centralized. >> Great. And uh well uh without Google SSO or OT your security posture will decrease across a variety of services. How are you mitigating mitigating this? >> Well, I don't think so. Like for example, if you will, it depends on your onboarding and offboarding pro processes. If you will be using uh ad hoc addresses for uh for logging into some services and always a unique password and you have everything handled in password manager what portal pass

basically exactly provides where you can create just one time addresses then it gives you better privacy guarantees and also better security guarantees than to have uh just one single point of failure which uh could be like hacked identity provider. And also maybe you could also see from the presentation uh one of the good things to avoid is like too much fragmentation of the services. So on one side yes we don't want to have one provider but on the other side like we don't want to have like 100 services for uh for like every small task. So this is also a security concern of course. So uh so the approach is also like eliminating the services that are not necessarily

needed. And uh Git is already decentralized. Why rely on Microsoft GitHub? And also just a second uh lots of people asking if you could share slides. Uh this session is being recorded and also being live streamed. So you could uh find it on uh Devcon app as well. And uh yeah, please answer this question. >> Yeah, I I think this was already answered as the first question. Sorry, once again >> that this was already answered as the first question.

>> Oh, okay. Um, shall we then move on to the Oh wow. Is there an image repository alternative from Google image? Uh, >> from Google image? Well, that's a good question. I'm not sure. Oh my god. >> I'm not sure. Sorry. >> All right. Well, thank you so much. [music] Uh