 Welcome to the Chrome Enterprise Technical Community Hour. Today, we'll be talking about long-term support. My name is Rich, and I'll be your host for today's presentation. Joining me today, we have our speaker, Thomas Kuczek, who's a technical program manager for Chrome OS. For today's agenda, I'll start with a quick introduction of the Chrome Enterprise Recommended Program and the Technical Community Hour. Then, I'll hand it over to Thomas, who will cover today's topic and the call to action for our Chrome partners. Today's Chrome Technical Community Hour is brought to you by the Chrome Enterprise Recommended Program, which is Google's partner program for third-party solutions that are optimized for Chrome OS or integrated with Chrome browser. The Technical Community Hour brings you the opportunity to engage with our team about new features and updates, enterprise development best practices, and our enterprise strategy. Now, without further ado, I'll pass it over to Thomas, and he'll kick us off. Thomas? Perfect. Thanks, Rich, for the introduction. And let me start my sharing session so I can click through my slides easily. Share. Perfect. So, today, I'm Thomas Kuczek, working for Google since around more than 12 years. So, long-term support is our topic. LTS is what long-term support is. And I'll be using LTS the three letters quite often today. So, let's start with the one sentence on what LTS is and then go into the details. So, LTS is our most reliable operating system for Chromebooks and Chrome OS Flex devices that receives only security updates for six months. All to action at the beginning, the middle, and at the end is test your apps on LTS. But I also go into more details about the sentence. So, Chrome OS used to have three major operating system version channels, which is Dev, Beta, and Stable. You know them since quite some time. And let me start with the why question. So, why did we create LTS? What's our inspiration behind it? So, we believe that stability, security, and low update costs are all equally important. This is what LTS gets. We believe that commercial customers and developers want stability and security and test all their applications less often, not that frequent as on Stable. We believe that LTS is the most reliable platform to run your applications on. The most secure run, it's definitely stable. It gets security fixes first, but the most reliable one is LTS. And running an operating system without security fixes is a security risk. So, I go into all of these four points into more details through the slides and through the whole presentation. So, let's ask how does LTS work? So, first of all, we only have two LTS releases per year. So, it starts at the beginning of March with 2023 with LTS 108 and ends in beginning of March 24 with LTS 120. And in between this 12 months from March to February, we have two LTS cycles and 12 stable releases. So, stable, we provide stable every month basically and only two LTS releases per year. So, once in a half year, one. LTS continues to receive frequent security fixes. So, we provide all the security fixes in stable from a release to the next release and during a respin inside a stable release. And out of these security fixes, we deliver many of them into LTS. So, you get frequent security updates in our LTS releases which actually have been proven on the stable channel already. LTS version numbers are in sync with our stable release channel but only exist every six releases, right? So, stable 108 becomes LTS 108 three months later. And when we release 114 stable in June, three months later, we release LTS 114. LTS only receives feature updates when updating from one LTS major version to another. So, LTS 108 stays feature-wise on 108 from stable but once it's end of life after six months and we release the new LTS release, you get all the features which you know from 108 to 140. So, all the new features that release during the time between 108 and 114 will find its way into LTS 114. So, when you update from LTS 114 to 120, you again get all the new features that 120 stable has. Devices update directly from one LTS release to another. So, if you update from LTS 108 to LTS 114, you get all updates with all firmware updates and all kernel updates that are necessary. We take care of this. And LTS is available three months after the corresponding stable release. So, we release 108 in December, three months later in March, 22, we release LTS 108. And you might ask yourself, what actually happens in these three months? So, why is there a delay? And the delay is actually LTC, which stands for Long-Term Support Candidate. And LTC, so Long-Term Support Candidate, is our preview release that shows how LTS will look like. There is a nice term that we have internally at Google, which says it has a three months, so LTS has a three months baking time. And this baking time for three months is what we call LTC Long-Term Support Candidate. And during this time, we ask you to provide feedback on anything that isn't working with LTC soon as quickly as possible. This is a time when we can change and adapt LTS very easily. Once LTS is out there, things are still changeable and possible, but it's way harder. So, to find bugs quickly in LTS and while you're on LTC, you need to be on LTC with some of your people. And we ask you to keep your IT staff on LTC. They should always be on LTC to see how LTS will look like and to test your applications on LTC quickly. We also ask you to keep about 5% of your production devices on LTC. So, you're not running LTC only for your IT department, but also in production somewhere where it's okay to run LTC. And it doesn't have to be LTS, our very, very stable version. So, LTC is available for six months. Same release timeline than LTS, but it is three months offset. So, it starts with 108 and once 114 is coming out, you get LTC 114 until you get LTC 120 in the same time when 120 stable is coming out. LTC, yeah, wait, I've been talking about this. LTC is available at the time when the corresponding Chrome OS stable release is available too. So, it's nearly the same timeframe. It's not to the second exactly the same timeframe, but once stable 108 is coming out, we provide you pretty nearly LTC 108. So, let's talk about pinning in our inspirational slide where I was talking about why we create LTS. I was also talking about security and actually an operating system which does not get any updates is definitely not secure anymore. But the reality is that we see this in the wild with our pinning functionality. We have it there. It's available at the admin console. You can pin all your devices to a certain version of Chrome OS and then these devices are pinned and don't get any updates anymore. We ask you to avoid pinning as much as possible because we see that the danger of forgetting pin devices is very high. I visualized this on the statistic on the left side. Thankfully, most of the devices 70% are not pinned. They are on the current stable release. There are some devices pinned on the current LTC and LTS version, which is marked in blue, which is also okay. They still get updates. And now comes the issue with these devices and the percentages in gray which are the current stable minus one, minus two, three, four and five and more devices which are pinned and actually are out of support by Google. So for one release or two releases, it might be not that bad. But we see around 10% of devices which are older than four releases back. And they're much older than four releases back. So if you pin on a version that is not current, you don't get security updates anymore. This is pretty important to know and every version of Chrome OS which is not the current stable or the current LTS or LTC release is actually unsupported by Google. So remember this when you pin devices and pinning is only possible on the major release versions, right? So you can only pin on stable 113 or LTS, LTC. The version number doesn't matter. But on these, on stable or LTS, LTC channel. So when we are talking about LTS and about pinning, we also need to talk about rollback. And rollback to the current Chrome OS LTS release is supported by Google. So you can rollback to the current LTS release. Rollback requires a target version to know to which version to rollback. And this is actually already pinning. So if you select the target version to the current LTS version, press the OK, a safe button, then you pin your devices to this specific LTS or stable version. And once a new LTS version is available, you need to change the target version to the new LTS version manually. So once you decided to pin your devices, it's up to you to take care of it. It's not Google that is updating your devices automatically and giving you all the security updates and feature updates for a new major release, which come within your major release. It's on you because you've decided to pin your devices on a certain version. You need to remember this and figure out when a new version is coming out, test this new version. And either unpin the devices or pin them to the version you have tested. But when it comes to update policies, Google is basically out of the game. You have a couple of information about rollback devices. So for the restored Chrome OS version to take effect, devices need to restart, wipe, and re-enroll into your account. We take care of this, but there is always a wipe included in a rollback, which means that data on the device, which is stored in some personal folders, will get deleted. But users see a notification that lets them know the local data will be automatically deleted during rollback. And if you have pinned to LTS, and your device is actually on stable with a higher version, you actually do a rollback current LTS. But if you have a device which is on an older version than the current LTS, you actually roll up to the pinned LTS version that you have set up in the admin console. It is quite obvious that you stay at the version that you have pinned for all devices in the organization unit that you have selected rollback. Good. So let me talk about how and how to get LTS directly in the admin console. It's really easy. So in the tree navigation structure, we have devices, Chrome settings, devices, and there are the device settings. And in the device settings long list, we have a section called device update settings. And I'm focusing on the device update settings for all the version control settings that we have. It's all in there. So if you want to get LTS, it's quite easy. We have a release channel section, which is usually, by default, set to allow users to configure. And then every user can configure for himself if he wants. Def or beta or stable or anything else. But as an admin, you can set this to long term support channel. So your organization unit gets LTS. And you find where you set up another organization unit for your IT department, which gets LTC. As I stated earlier, which is quite important, that you also see issues early. So this is how you get LTS and LTC. If you want to pin a device which we're not recommending, this is also be done in the device update settings section. So release channel was down there. The target version, which is pinning, can be controlled here. The default value is use latest available version. So it automatically updates itself. But you can choose long term support, for example. So the devices are pinned to the current LTS version. If you want to add rollback to this and your devices have a selected target version, it's, again, just one click. It's intersection rollback to target version. The default value is do not rollback OS. You can change it to rollback OS. And then rollback is enabled for this organization unit. When you add a device into your domain, into this OU, it automatically rolls back or forward to your selected LTS version. So I was talking about that if you use pinning, you need to remember yourself when a new version of stable or LTC is coming out and you need to test it. And you need your three months time during the LTC period. And then if LTS becomes available, you need to set pinning to the new LTS version yourself. And if you ask yourself, how do I know when this is happening? We have a release schedule calendar out there. It's available under chromium-appsport.com. And there is a schedule section, which tells for every single release when it becomes beta, when it becomes stable, when we have a planned refresh cycle. Is it an LTS release or an LTC release and when it comes out? So for 114, the LTS release is available on the 19th of September 2023. And the LTC release, which comes three months earlier, is available on the 13th of June 2023. You can press this next button on top as often as you want. It goes really, really far into the future. Let's go to the next slide, which is about security updates. I know that security updates can be viewed as a risk. And with this slide, I want to take you to the fear of the security updates being viewed as a risk. And I think you will pretty soon understand why. So we have two kinds of security updates. We call them security respents. We have the planned security respents and the one of security respents. Let's start with the planned security respents. So security updates get collected and distributed every two to three weeks into LTC or LTS. And most important about this is that the security updates are first released to our stable channel. That's why our stable channel is the most secure channel before they are being approved and merged to LTS. So when we merge security fixes into LTS, they've been out the security fixes, a fix in the field on millions of devices in the stable channel already. So if something is wrong there, we know this very, very quickly because it's been tested on millions of devices. We also have one of security respents for very critical security updates only. We have the capability to use this. And still with one of security respents, they land in our stable channel first. We let them bake or we make sure that nothing is happening on the stable channel with the security fixes before we merge them into LTS. So what is included into a security update? So it's Chrome OS update, security update. It can include kernel security fixes. It's also Chrome browser security fixes, which we get from the browser team. And it's also Android security fixes. So let me tell you about the reasons for admins So if you're an admin, why should you use LTS? And I think if you want stability over a six-month time frame and not only for a month, LTS is for you. If you want to update your device fleet every six months only, LTS is for you. If you want to test your applications for compatibility on LTC and LTS, right, you need LTS and LTC. It's definitely more secure than pinning because it receives frequent security updates. Pinned version on stable, when we have a new version coming out, become stale, they don't get any security updates anymore, and they become vulnerable against attacks. And LTS is not new. We have it since November 21. The first LTS release was LTS 96, which is already quite some time ago. A little bit old. We have LTS 108 now, right? So if you are a developer, what are the reasons to use LTS? I think the most important one is we already have 11 million devices on LTS. So it's a release channel, which is already highly used by our customers. I've also looked back in time into January 2022 and compared this to 2023 made. And we grew the number of devices on LTS 10 times. So LTS does not only have a lot of many million over 11 million devices running LTS, but it's also on a speed trajectory on consumers or enterprises use LTS and are not unstable, but coming into LTS. LTS is a fully supported Chrome OS release by Google. We run thousands of tests for every LTS release to ensure its stability. And we are stable. And I was talking about this already. It's our most secure channel. LTS is our most reliable release channel. So last slide. Now you see it because it looks best. And someone told me makes the last slide really inspirational because it sticks long on the screen. So fully support and test your applications on LTS. And even more important, update your website and let your customers know that you fully support LTS. It's not that complicated if you think about it because let's say we are talking about stable 108. You have been testing for stable 108 already. So you know that it's working on LTS 108. But during the time you might test for stable 109, 110, 11, 12, and so on. But remember to test on LTS too because there are many devices out there running LTS already. Thank you for listening. That's it. And I'm giving back to Rich. Rich, your last slide. Thank you, Thomas. Please visit the Chrome Enterprise Developer website for additional information to supplement your learning. That concludes today's presentation. We look forward to seeing you next week.