Ask HN: Google Drive/Office 365 alternatives
My partner runs a small charity in the UK whose office infrastructure is based on Google Drive. (Sheets, spreadsheets, email, etc). Her trustees are advising that since Google cannot guarantee that her data is being stored in the UK (apparently?), they need to migrate. Like seemingly every organisation these days, they're looking at MS Office 365. But having a partner with GNU and emacs stickers all over their laptop, she's wondering what alternatives are out there. It'd need to be low (or better no) maintenance, comparable in cost to Office 365 and quality too. It could be web-hosted or based on Next/OwnCloud or something, as long as it works without a load of pain points. Oh and UK-hosted too. I assume others here must have thought this through already, so thought I'd ask the hivemind!
123 comments
[ 2.5 ms ] story [ 236 ms ] threadI'd check the specific requirements though. Even DPA doesn't really require hosting in the UK, but UK or country with matching privacy requirements, which in most cases means whole EU is ok.
Google apps are a good alternative to Office365 but we haven't found anything that matches Excel. We're a fintech so there's no way around excel. You'll also have to deal with users who are using excel files locally.
[1] https://www.libreoffice.org/download/libreoffice-online/
Oh, GNU/emacs? Well, You can run your own OSS openoffice/sunoffice (whatever it's called nowadays) and file sharing but it's alot of work and not no maintenance.
site: https://www.techsoup.global/
She should push back on that, since there is no legal basis for it (except in very specific circumstances).
It would be cheaper to get competent legal advice than do a shift like this for many offices.
To remove GDPR from the UK we'd have to change the data protection act.
I am not an expert on UK Law but I also wondered if it is possible that the reference on the GDPR would still be valid
https://en.wikipedia.org/wiki/Regulation_(European_Union)#De...
So you can make legislation around a Regulation but can't override its effects.
Is that possible with companies in USA? How?
This joins a long list of bullshit reasons to do things, that often isn't based in understanding of what The Thing is actually requiring.
"Computer says no", "health and safety", "more than my jobsworth", "data protection", "safeguarding", "the regulator says", etc etc etc.
I am in touch with other DPOs and our federal dpos - the big elefant in the room is Microsoft and Windows 10. Everybody knows that you can't use it if you follow the GDPR or at least you have to jump so many loops that it is practical impossible.
The federal DPOs advice against Teams and OneDrive so Microsoft gets the message but if the CJEU looks at Windows from a GDPR perspective Everybody had to stop using it.
Ok this is the legal stuff.
Here is the technical stuff [1]. In short: Windows 10 sends all kind of data including whole documents to Microsoft USA and you can't stop it using the OS but have to apply Firewall rules and DPI.
So if you really want to use Microsoft you have to make a Data protection impact assessment for each new version of windows 10. I know no one who does this. But if you ask the federal dpo they will tell you that they can't say if you can use windows 10 for this or that but you should asses it yourself using a data protection impact assessment.
I just hope nobody will ever touch this sticky ball
[0]https://www.microsoft.com/en-us/licensing/product-licensing/...
[1]https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat...
In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.
Windows is GDPR compliant. See section 3 of https://docs.microsoft.com/en-us/windows/privacy/windows-10-...
GRDP compliance isn't too bad for a company like Microsoft who has decent data auditing ability. It's pretty easy for them to give you your windows data and delete it if required, and that's what is required for basic GRDP compliance.
If there is public advice otherwise a citation would be useful.
Note that your subsequent comment claiming that FISA request make GPDR compliance impossible is also incorrect as they are explicitly excluded (as law enforcement) by the GPDR: https://ico.org.uk/for-organisations/guide-to-data-protectio...).&text=However%2C%20it%20is%20covered%20by,for%20national%20security%20and%20defence.
Official citation:
Dutch DPA
https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-micr...
THere is a excemption for Law Enforcement but it even law enforcment has to comply with basic human rights:
In paragraph 183 of C-311/18, the CJEU also found that US surveillance “in transit” (like “Upstream” or taps of the underwater cables) violate EU fundamental rights.
"Microsoft plans to rectify the situation through the next Windows 10 update in April 2018. This will end the violations noted in the Dutch DPA’s investigation report.... Microsoft has agreed to do this, and the Dutch DPA will monitor implementation."
https://autoriteitpersoonsgegevens.nl/en/news/privacy-window...
"In transit" US surveillance applies to all providers (including non-US providers) so doesn't preclude Microsoft.
As you stated Microsoft can and will update its Practices to be more Compliant if enough pressure is applied.
I have more citations and also newer but they are in German.
Office 365 and Schools: https://datenschutz.hessen.de/pressemitteilungen/zweite-stel...
Checklist on Videoconferencing (including Teams): https://www.datenschutz-berlin.de/fileadmin/user_upload/pdf/...
And on the technical side:
https://www.bsi.bund.de/EN/Topics/Cyber-Security/Recommendat...
The Berlin DPO stated that Microsofts Data Processing Addendum is not Compliant with GDPR (second link) so wherever it is applied you are also non compliant as data controller.
Ok this is all heavy on Microsoft and I am not stating that any other company is better off. The bottom line is this: US Law violates the basic human rights guaranteed by the EU - there is no appeal for non-US citizens and the "full take" of all data is disproportionat. If you can not shield EU citizens from the regarding US Laws you can't use an US Service.
Thats the consequence from the CJEU ruling.
It says they will allow the use of Office 365 in schools.
It's not as much as allow but tollerate if certain prerequirements are met e.g. not sending any diagnosis data to Microsoft. And it sounds more like they are somewhat pressured into it. Intensive talks...
I would advice for Nextcloud and Onlyoffice. If you are hardcore data protection.
> Trustees have overall control of a charity and are responsible for making sure it’s doing what it was set up to do. They may be known by other titles, such as:
> Whatever they are called, trustees are the people who lead the charity and decide how it is run. Being a trustee means making decisions that will impact on people’s lives. Depending on what the charity does, you will be making a difference to your local community or to society as a whole.> Trustees use their skills and experience to support their charities, helping them achieve their aims. Trustees also often learn new skills during their time on the board.
https://www.microsoft.com/en-us/microsoft-365/nonprofit/offi...
https://www.microsoft.com/en-us/nonprofits/eligibility
You can create an account and upload the documentation https://nonprofit.microsoft.com/en-us/getting-started
1) What law they think is being broken (and they need to actually link the specific clause)
2) Why they think G Suite is breaking it (and they need to describe that breach in terms of the law they think is being broken).
3) How much they're prepared to spend on changing from G Suite to something else, including costs of migrating data, checking it's correct after migration, re-training, and any possible software and support costs.
G Suite claims it's GDPR compliant. https://cloud.google.com/security/gdpr
[1] https://www.libreoffice.org/download/appimage/
https://www.libreoffice.org/download/flatpak
Either way, the fact remains that the OpenOffice development community imploded and takes a long time to even fix security issues.
Yes, file formats are usually interchangeable. No, that interchangeability is not perfect, especially once you get away from word processing and into spreadsheets and presentations.
The majority of people your partner has to work with outside of their charity will be using Office so these small issues will constantly cause friction and frustration.
Does your partner want to waste time on those issues or do they want to focus their energy on the good work of the charity?
And, since we're talking about a charity, O365 is probably available at a reduced price, or even free.
https://www.techsoup.global/
> Seriously, just use Office 365. Otherwise you'll forever be dealing with a constant low grade stream of interoperability glitches.
The obvious answer is that they're already using an alternative to MS Office if they're using Google, and the reason for the migration is not interoperability issues.
Importantly, however, Office 365 is also not a usable alternative if you need perfect interoperability with MS Office files. Trust me on this. I've had an administrative position for the last couple years. Suddenly I went from rarely having to deal with MS Office files to a steady stream of them.
No big deal, I thought, since my employer uses Office 365. It's literally a joke to think you can share files with users of the desktop version of MS Office. Many, many times a message has popped up telling me I need to open the file in the desktop version if I want to edit. (And I don't think it supports the older Office files at all.) I mentioned that to the secretary and she just laughed and said you can't do collaborative work with the online version when everyone else uses the desktop version.
While using the Office web apps, I have rarely seen the "you need to open this file in the Windows desktop version of XYZ to edit the file" message in the last year and a half at Microsoft, a company that intensely uses Microsoft 365. In every case that I can recall, this message showed up in one of 2 cases:
1. Macro-enabled files - there is no VBA or .NET programmability for the web version.
2. Files protected with M365/Azure information protection (DRM/IRM).
I don't think either of these scenarios are likely to occur in a charity/nonprofit, which was the original post's concern.
As for me personally, I hardly ever wanted to edit files in either category intentionally - the macro-enabled files are old archival docs and the DRMed docs are announcements from executives.
> And I don't think it supports the older Office files at all.
True. M365 can convert .abc Office files to the .abcx format, save the converted copy, then open it for viewing and editing. That all happens in 1 step but is not the same as supporting the old formats to begin with.
> I mentioned that to the secretary and she just laughed and said you can't do collaborative work with the online version when everyone else uses the desktop version.
Ironically, I find that to the extent this is true, that's because the desktop version has fewer features. Make a comment on a Word doc? If you did it in the web version, your collaborator gets an email with the comment text, and if they're using the Outlook web or Windows desktop versions, they can even reply to the comment from within the email preview without having to click Reply or open a link to the doc. But if you did it in the desktop version, all your collaborator gets is "Comment previews are coming soon to the version of Word [you] used!" where "soon" has been soon for at least a year and a half.
#1 This is 2020 and everybody's collaborating on a single doc with comments. But how do you point someone to a comment with a link? In Office 365, you can't.
#2 Until recently office 365 didn't even have a grammar checker / proofing assistant.
#3 You've worked on a document and intend to quickly send a pdf over to an email? You download the file, convert to pdf and email it. Even a simple "Send this file as an email attachment" isn't available in their editors.
#4 Talking about file-format compatibility, like someone else has pointed out there's no guarantee that documents created in the online version is compatible with their desktop editors. Too bad.
#5 In version history, how can you compare two versions of the same file? Well, you can't.
Remember for Google and Zoho, cloud based document editors was their target, right from idea to finished product. For Microsoft, it was an afterthought. And it shows.
Seriously – if you use Docs or Sheets and want to move off, you've either got to manually export everything to an interchangeable format, or just give up and leave a bunch of stuff behind.
This is a particular pain when shifting between Google accounts, or closing an account down (for example, at the end of a job.)
After some time of processing it'll eventually give me a .zip which contains all the documents and files. Google Docs documents are exported as MS Word .docx files. I don't have any spreadsheets to hand, but I believe they're exported as .xlsx format files too.
e: I see Google Takeout also allows you to export these, too in choice of formats: https://takeout.google.com/
BACK UP YOUR GOOGLE ACCOUNT PERIODICALLY. GOOGLE CAN AND DOES RANDOMLY DISABLE THEM WITH THEIR CHAOS MONKEY ACCOUNT THWACKER. If they detect suspicious activity -- and their algorithms aren't particularly good here -- they WILL close your account, wipe your data, and there is no support.
What? Visit https://drive.google.com/ and your files are there.
Or, even better: open a .gsheets or any .gEXT file in your favorite text editor. You'll see that they are comprised of web markup language, much like an XML doc. I don't have one in front of me atm, but I recall thinking, "it's basically XML that points one's browser to the appropriate Google app and a unique ID for the document."
[^1]: https://support.google.com/docs/thread/10078336?hl=en [^2]: https://support.google.com/docs/thread/10078336?hl=en&msgid=...
The only pain point is that the Drive API seems to omit checksums for these types of files, so they're always downloaded even when they haven't changed.
I only have a handful of these so it's only a minor annoyance but I imagine it could get ugly if you are a heavy user.
WAS an afterthought, 5-7 years ago. Now we at Microsoft often find that the desktop version is the afterthought; see my other comment (https://news.ycombinator.com/item?id=24400026 ) for an example.
Typing isn't synced anywhere close to real-time, for example, and glitches abound.
It's tough to retroglue this stuff in!
Microsoft pushed styles hard for so long, it still takes up a massive chunk of the ribbon menu by default, yet the online version doesn't appear to let me create or update them.
This is a fairly fundamental feature of Word. Add text, apply style. It can't do one of those.
Counterpoint: This is not a bug, it's the best feature of Office 365.
This is a bit of a rant, but the worst thing about Google Docs is how it encourages this terrible working pattern, where everyone wants to edit the same exact document at the same time like some kind of cursed nightmare Etherpad, without any way to reasonably handle merge conflicts, and with comments on comments on markup for lines. And every keystroke you press is logged indefinitely so you can't type anything out without everyone watching over your shoulder.
Just a personal opinion, but as a paying Office 365 subscriber, Office 365 is at it's best when it fundamentally rejects Google's workflows and offers it's own. Besides, if what you really want is Google Doc stuff, you can already buy that from Google today anyway.
A comment/request suggestion feature sounds like a good one, but I think the way Google did it is far from ideal.
[1] https://writer.zoho.com
Note that this isn't theoretical. I see several documents a week that render funny in online o365. Misaligned bullets, wrong font, etc. Occasionally ones that just don't work at all.
I haven't used it myself, but a number of people on this forum have advised that it's got significantly better compatibility with MS Office than any of the other contenders.
This may have been in word processing only, however, and as the GP notes, spreadsheets and presentations add their own headaches.
It is also much slower compared to Google Docs, in terms of loading time and latency, and has an abundance of rendering glitches.
not related to them, not even a user.
I supported all the technical aspects of a friend’s charity in their early days. Originally set them up on Zoho for cheapness before they were a fully registered charity. Zoho worked but caused plenty of pain for their less computer proficient users (volunteers and trustees). The Zoho UX is very clunky and the team required a lot of support. Migration to Office 365 made everyone very happy because of the familiarity (everyone is used to it from work). The charity requires less support time now and no longer complain about Zoho’s limitations.
You will never the conveniences of the a paid powerhouse developed by thousands of people over the years, but for next to nothing cost and a little bit of effort you can be just as productive.
I would still suggest this approach; just saying it takes a bit of work.
For security it does allow 2 factor auth and the admin account has all the tools to manage users and query what they have shared.
While it's not an enterprise solution... but for their use case, and with the amount of features it offers, i think it's something worth considering even with the non trivial initial setup tax.
https://support.google.com/a/answer/9223653?en
(Though this may involve upgrading to a paid business license for G Suite, if your partner is currently using the free charity tier.)
Just because of the headache involved in transferring, I'd ask her to check with legal again. It would be very unusual to require UK-based storage specifically.
If that truly is a requirement, then cloud storage is basically not an option. Just keep everything as Office documents on a local network hard drive and set up recurring backups to an off-site location (probably your partner's home).
Since Google doesn't have any datacenters in the UK, Google clearly cannot guarantee that your data is stored there. In fact it is guaranteed that your data is not stored there.
https://www.google.com/about/datacenters/locations/
Maybe not so unusual post brexit?
I'm not sure how UK domestic equivalent of GDPR ends up now and after re-negotiation with EU/EC?
ed: see also: https://news.ycombinator.com/item?id=24398861
Plan Details: https://www.zoho.com/one/plan-details.html
I am not affiliated to them.
Notes + PM -> notion.so
Word -> notion.so
PowerPoint -> slidebean.com or pitch.com
Excel/Access -> still AirTable
Outlook -> amazing email UX via hey.com for $99/year
I got many of these via alternativeto.net and producthunt.com