alex123

My main problem with many MDM tools is that they often aren't architected securely.

Ask yourself the question, if my MDM provider gets hacked (just like Solarwinds did), what's the worst that could happen?

For many MDM providers, the answer is:
- They can execute arbitrary code on any machines,
- impersonate your CEO,
- install crypto ransom and
- exfiltrate all your data

I wish more MDM providers would offer something along these lines:
- MDM providers should ideally avoid running agents on end-machines, and instead rely on the macOS framework to deliver configuration.
- If you are running an agent, that agent should be bootstrapped with a certificate signed by the organisation, and the private keys shouldn't be available to the MDM provider. Every payload/config push should be signed, and any agent software update should be cross-signed by the organisation and the MDM provider.
- That way, if the MDM provider is hacked, they cannot run arbitrary code and they cannot ship malicious updates.
- Code for any agent should be open-source.

I'd say not having a rechargeable battery (built-in lithium battery) is a huge plus.

- Changing a battery is quick, takes a few seconds.
- Tricky to charge stuff outdoors, need to bring cable and (I guess) a computer or power bank to charge from.
- Batteries does eventually wear out. If they are built-in, you need to throw the whole device out. With batteries, you can just replace them.
- Batteries are also rechargeable. Instead of having every item in your household with built-in batteries, with separate charging cables for all of them, it's much better to use external batteries and a single charging station for regular batteries.