Live data from Hacker News

Microsoft lost its keys, and the government got hacked

techcrunch.com

111–120 of 151 posts

Re: Microsoft lost its keys, and the government got hacked

#111
post #77

Earlier quoted context omitted.

I’d go with Gmail…

Their pricing has become bonkers over the last few years. Most people in traditional businesses need o365 for word/excel/powerpoint, and you effectively get email for free, so for many companies its a no brainer.

Until this happens

Re: Microsoft lost its keys, and the government got hacked

#112
post #31

This headline does a good job of pointing out why we shouldn't allow backdoors in encryption.

no one said it was a backdoor, though. you have to have a key to encrypt stuff, and it was that key which got leaked, somehow . a backdoor is a way around the use of a key to see secret messages, or an alternate key which allows you to view messages without compromising the key which encrypts messages in normal operation. could have been a backdoor, sure, could have been something else. could have been carelessness.…

> no one said it was a backdoor, though.

That includes the comment you are replying to.

Re: Microsoft lost its keys, and the government got hacked

#113
post #31

This headline does a good job of pointing out why we shouldn't allow backdoors in encryption.

no one said it was a backdoor, though. you have to have a key to encrypt stuff, and it was that key which got leaked, somehow . a backdoor is a way around the use of a key to see secret messages, or an alternate key which allows you to view messages without compromising the key which encrypts messages in normal operation. could have been a backdoor, sure, could have been something else. could have been carelessness.…

If Microsoft can’t manage to hold onto these critical encryption keys, why do you think that will?

When your data is stolen because you were working in Cancun and the Mexican CIA was compromised, will you ever even know?

The point isn’t blaming a back door, it’s just pointing out that the more stakeholder that possess a key, the higher the probability of a compromise.

Re: Microsoft lost its keys, and the government got hacked

#114

Earlier quoted context omitted.

This really surprised me when I learned of this story on the weekend. Very little discussion, very little reception in IT news. Someone hacked Azure AD [1] and accessed the data of 25+ orgs and the reaction is *crickets*? [1] I'm not exactly sure which Azure component was hacked and the MS communication seems intentionally unclear and obtuse on this. It sounds like the private keys of Azure-internal auth servers were…

This is not even the first time this year that Azure AD has been owned sideways. See this mind-blowing blog post from Wiz where they live edited bing.com search results, injected XSS into O365, accessed exabytes of internal MS file storage and more: https://www.wiz.io/blog/azure-active-directory-bing-misconfi... I have no idea how Azure maintains its reputation as a safe enterprise choice. Microsoft really just has a…

I mean, we’re talking about key federal agencies involved as the impacted customer(s), too. Yet it’s like, eh, next story.

Re: Microsoft lost its keys, and the government got hacked

#115

Earlier quoted context omitted.

AWS is pretty decent in my experience, and when managed with Terraform (which is all but a requirement if you don't want to go completely b0nkers) it's a breeze to manage.

And this is one place where I think Azure does better... I mean, the UI/UX sucks, but at least you can do everything in the UI without loosing too many brain cells. Google and AWS seem to require automation tooling to make sense, which IMO makes all of it harder to learn in practice. I tend to like learning some of those things visually first, then automate out of necessity as opposed to the other way around. Not tha…

I'm not sure I agree completely. When I was learning Terraform, trying to figure out what the options a resource had and some of the possible values, I'd make the change in the AWS UI, then re-run Terraform to see what it wanted to change back. There weren't a whole lot of things in aWS that didn't have a UI to configure somewhere.

Re: Microsoft lost its keys, and the government got hacked

#116
post #32

I hate to go negative. I really do because, usually it doesn't improve the discourse whatsoever. However, I feel like it needs to be said: Microsoft makes bad products[1]! They're overpriced, insecure, slow (it's astounding to me how slow their web properties are), and hard to use. Easily some of the worst UI I've ever seen and, what's worse, they've been like that my entire career. They keep slapping lipstick on the…

Linux on the desktop is here. Go all-in on KDE. Everything is seamless and just works.

None of the comments here seem to address desktop OS in enterprise/government environment, which is what this article about. Linux desktop OS your personal computer? Sure. In an organization where most users are not technical, and where vendors do not release their software? Good luck.

Re: Microsoft lost its keys, and the government got hacked

#117
post #71

Earlier quoted context omitted.

I moved from Azure to AWS. App Insights, DevOps pipelines, and WebApp slots look like future tech when compared to codepipelines and x-ray. DevOps in particular feels so close to being a really great tool. Not having to jump between 8 different UIs to deploy something is magical. If only they'd polish the rough bits and invest a bit more into it.

We use DevOps for pipelines, but AWS for our prod cloud environment.

I'm hoping to push us that way, some hurdles with getting buy in from the whole team though.

That's why I wish DevOps made it a really clear cut choice. There's some really low hanging fruit and silly decisions that spoil the initial impression:

YAML pipelines have been the "official" option for at least 4 years now but when I create a new project, every issue has a "deployments" section that tells me it only supports classic releases. Classic pipelines/releases can now be disabled at the project level at least.

They're introducing a new widget that shows open pull requests across repositories but for an absolutely insane reason it's limited to 10 repositories, just why...

Environments still have no support for resources other than VMs and AKS.

The mandatory "sprints" backlog is just stupid as well. It's a clear artificial limitation rather than one necessitated by the platform.

Another issue is that Microsoft have done a poor job at communicating the potential longevity of the platform. The Github acquisition is the first thing that gets mentioned when DevOps is brought up as an option, which is a shame because DevOps feels much more capable/cohesive/advanced than GitHub.

Despite these problems it's still been the tool with the absolute least friction and most potential when it comes to organised development work. The alternatives I've used come nowhere close.

Re: Microsoft lost its keys, and the government got hacked

#119
post #32

I hate to go negative. I really do because, usually it doesn't improve the discourse whatsoever. However, I feel like it needs to be said: Microsoft makes bad products[1]! They're overpriced, insecure, slow (it's astounding to me how slow their web properties are), and hard to use. Easily some of the worst UI I've ever seen and, what's worse, they've been like that my entire career. They keep slapping lipstick on the…

It's even more hilarious because Microsoft are always loudly exclaiming telemetry is necessary for software improvement but based on how buggy and terrible most of their software is telemetry doesn't seem to be helping.

Re: Microsoft lost its keys, and the government got hacked

#120
post #91

Earlier quoted context omitted.

After spending 5 years of corporate work having to wrestle with Azure (in a ci/cd capacity) I would never recommend Microsoft's cloud offerings to anyone. Problem is that there is no other provider I would rather recommend. They are all bad in one way or another.

As a counterpoint: I've worked with both Azure cloud and Azure DevOps (or whatever the feck they call it now) for a long time (maybe 10 years?), a lot in a corporate setting, but also for my startup. Apart from the same price issues that exist across all the big 3 cloud providers, I actually really like Azure.

I love the conceptual framework and high level architecture of Azure: Resource Manager, sane naming compared to AWS, etc…

What I hate is the unfathomably sloppy implementation that their developers refuse to fix unless held at gun point.

You literally have to have an MS account manager about to miss out on millions of dollars to force a trivial fix through their pipeline.

They have zero “customer obsession.”

Post reply on HN