Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Everything authenticated by Microsoft is tainted

graz.social

Post reply on HN
Print view View original

141–150 of 381 posts

Re: Everything authenticated by Microsoft is tainted

#141

Post by epups »

tpool wrote: post #49

If the lesson the author is ultimately trying to convey is "You can't trust cloud infrastructure providers to protect your data, especially Microsoft." My answer is, "Okay. What can a company do when there is no choice?" The number of enterprise-grade applications that are cloud-only offerings is only increasing. Regardless of whether or not my company actually wants to to own the risk of storing its data in a third…

You can implement security measures on top of what is provided by Microsoft. If you have encryption at rest and you hold the keys locally, for example, even this high-level leak would not expose you.

That said, good luck implementing and managing that in a large organization.

Re: Everything authenticated by Microsoft is tainted

#142

Post by carstenhag »

xyzzy_plugh wrote: post #129
foepys wrote: post #42

Earlier quoted context omitted.

Microsoft is luring in non-tech companies with Active Directory and Office 365 and then catches them with promises about good integration into all services. Once the companies are in the Azure dashboard, why not try those fancy services they offer? It's all smoke and mirrors but it works.

I'm honestly surprised they haven't been trying to bundle GitHub more (or vice versa). It does work and it is very compelling, at least on the tin. The problem is convincing powers that be that it doesn't do what it says is borderline impossible. The most they've built is equal parts astounding and terrifying. In a sort of funny twist I feel like this is an area Google could really excel in if they got their shit tog…

Observation from german companies (smaller eg 250 employees, mid, big): Azure DevOps is used. Noone uses GitHub. I am sure it's widespread, but rather for small companies

Re: Everything authenticated by Microsoft is tainted

#143

Post by nottheengineer »

etothepii wrote: post #72
mschuster91 wrote: post #40

Earlier quoted context omitted.

> I can’t for the life of me figure out how executives at big Fortune 500 move their workloads to Azure. Almost every organisation already has a huge-ass contract with Microsoft for Windows, AD, Office, Teams, Exchange and whatnot, deeply integrated with their core IT. So if the organisation doesn't already have AWS set up as a supplier, it's usually easier to push for an existing supplier instead.

I think of our company as an "indie" startup and we use Office365 for email. There are a bunch of things that I hate about it but what are the plausible alternatives? Before we moved to O365 85%+ of our emails landed in spam folders.

There's google, which is less infuriating to use than microsoft stuff from what I've heard. Microsoft, google and yahoo regularly block or delay mails from independents[1].

[1] https://news.ycombinator.com/item?id=35380823

Re: Everything authenticated by Microsoft is tainted

#144

Post by dogleash »

courseofaction wrote: post #128
bastard_op wrote: post #104

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To…

Another reason I am in love with LLMs. You don’t need to know the software like the back of your hand - a new environment is like a new programming language, as long as you’re able to ask the right questions new environments will be far more accessible. Experienced admins should know the requirements, and not be limited to the tools. Migrating will be relatively cheap. No wonder they’re hobbling the tools (/tinfoil),…

I'm not so convinced a LLM remixing all the tutorial blogs its ingested is a meaningful quality step above those tutorial blogs themselves.

Earlier this year we had a linux task that was above the normal complexity my team deals with. So a few people threw it at chatgpt and were amazed at how good the results were. In reality, it was full of outright factual inaccuracies and non-breaking bad decisions. But their skill ceiling prevented them from seeing how bad the output was.

I didn't want to be a wet blanket, so I let them have their fun and quietly guided the jr working on the resolution through an appropriate implementation.

Re: Everything authenticated by Microsoft is tainted

#145

Post by the8472 »

chiefalchemist wrote: post #119
bastard_op wrote: post #104

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To…

> That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To Linux? The short answer is...yes. Of course it isn't easy. Of course it would take time. But it's certainly not impossible. It's certainly been done. I'm not defending MS but the idea that they're some sort of siren and companies can't help themeselves...well, please get me a list of those companies so we shor…

It's not the first time that a company got compromised due to microsoft software. This time it was their cloud offering, the previous N times it was AD, Exchange, Outlook, WSUS (for delayed updates), ... And even if they'd move to something else they'd reach for solutions that also get their tentacles into everything because those solutions are convenient during those time windows where they're not exploited.

Re: Everything authenticated by Microsoft is tainted

#146

Post by dizhn »

xyzzy_plugh wrote: post #132
dizhn wrote: post #108

Earlier quoted context omitted.

85%? I can't imagine even dedicated spam hosting companies in China having that kind of deliverability issues. That is seriously bizarre.

Sometimes you get a bad roll of the dice when you choose a lesser known email provider and you start with worse than average reputation. Can never go wrong with Gsuite, O365, etc.

OK. Maybe the "email provider" part is the problem. They were probably lax on spammers or they couldn't keep up with them.

I have experience with hosting my own on dedicated servers. It's mostly been fine.

Re: Everything authenticated by Microsoft is tainted

#148

Post by epups »

The writeup by Microsoft is far more illustrative than the frankly confusing post and blog from the main article: https://www.microsoft.com/en-us/security/blog/2023/07/14/ana...

Also, unlike what (I think) is being claimed here, Microsoft did fix the issue after learning about it: https://msrc.microsoft.com/blog/2023/09/results-of-major-tec...

Re: Everything authenticated by Microsoft is tainted

#149

Post by TedDoesntTalk »

bastard_op wrote: post #104

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?" That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To…

> deserve what they get sadly

This is incredibly insensitive and dismissive, and victim-blaming.

Re: Everything authenticated by Microsoft is tainted

#150

Post by tpool »

squarefoot wrote: post #117
tpool wrote: post #49

If the lesson the author is ultimately trying to convey is "You can't trust cloud infrastructure providers to protect your data, especially Microsoft." My answer is, "Okay. What can a company do when there is no choice?" The number of enterprise-grade applications that are cloud-only offerings is only increasing. Regardless of whether or not my company actually wants to to own the risk of storing its data in a third…

> "Okay. What can a company do when there is no choice?" The number of enterprise-grade applications that are cloud-only offerings is only increasing. I'd be curious to know what kind of problems could be only solved through a cloud-only solution. It's a honest question; I'm not old enough to remember actually using mainframes but in my days companies had their own IT staff, gear and storage. I understand that hiring…

Software security is a good example. Lets say you work for a large company, you have 50K repos in your git instance, and you have 10K developers on staff churning out all of that software from the mundane to the mission critical. You want to provide a means for your developers to be good citizens to get out in front of security vulnerabilities.

Building an in house solution to do this is extremely costly in every way imaginable, from the extreme expertise needed, to the ability to do it at a very large scale.

There are a number of vendors out there who provide great software to do things like scan source code, scan dependencies, or scan a live environment for vulnerabilities. The best of those vendors have cloud-only solutions.

You're stuck either accepting the risk that, at the very least, vulnerabilities about your software would be potentially exposed for the world to see, or installing an inferior product on-premise. That potential risk is even greater if your customers depend on you to store things like private and/or financial data.

Post reply on HN