Earlier quoted context omitted.
At best, incompetence. At worst, corruption.
If so, you don't seem to understand why the DoD is failing to pass one, but are very well versed in the outrage you're supposed to feel when it does.
Care to enlighten me?
Microsoft is a national security threat: ex-White House cyber policy director
201–210 of 224 posts
Re: Microsoft is a national security threat: ex-White House cyber policy director
#202Earlier quoted context omitted.
The US government spent $6.1 TRILLION dollars in 2023. I don't think raising taxes is the solution to the government offering a more competitive wage.
That number is meaningless without also considering US GDP (even if you write trillion in caps). The US averages about 14% government spending as a fraction of GDP, placing it at ~90/140. For the size of the US economy, spending should be significantly higher.
You are ignoring state government expenditures.
>...The US government's Bureau of Economic Analysis as of Q3 2023 estimates $10,007.7 billion in annual total government expenditure and $27,610.1 billion annual total GDP which is 36.2%.[1]
https://en.wikipedia.org/wiki/Government_spending_in_the_Uni...
>For the size of the US economy, spending should be significantly higher.
The percentage shot up during the Covid spending and is still slightly above the historical average.
Re: Microsoft is a national security threat: ex-White House cyber policy director
#203Earlier quoted context omitted.
This is a straw man. Even if the top richest people paid an additional 16 billion in taxes that would run the gov for like a day. Our problem is with spending.
I agree. We don't spend enough money on everything, most notably housing.
How can we possibly spend more?
Re: Microsoft is a national security threat: ex-White House cyber policy director
#204Earlier quoted context omitted.
I agree. We don't spend enough money on everything, most notably housing.
The top earners only need so many houses and places to live, even including corporate housing. The median population doesn’t have the money to spend.
Isn't that a problem caused by inflation which is driven (right now) by gov spending.
Re: Microsoft is a national security threat: ex-White House cyber policy director
#205I'm not a fan of Microsoft, but this is some amazing blame shifting. The root cause of the problem is the government single-sourcing a vendor and being incapable of negotiating with said vendor. The US government is 10% of Microsoft's annual revenue just on security services (if I read the article correctly) but is failing to negotiate. The right answer here is if the situation is that bad, make a very public long-te…
Your post is some sort of victim blaming, how would multiple vendors or a better price improve security?
Could be the opposite. Every provider is an attack vector of the government's network.
The problem is MS fucked up big time by not only losing a key but also that this key is a master key due to an error.
Not to mention they downplayed the problem afterwards and tried to charge customers for the logs needed to identify the attack.
Re: Microsoft is a national security threat: ex-White House cyber policy director
#206Earlier quoted context omitted.
You should probably try building a pure capability based operating system and making it usable, before blithely saying the entire industry got security wrong. Capabilities aren't magic. UNIX has had many forms of capability for a long time, NeXT/macOS/iOS uses them extensively as well, and there are still vulnerabilities regardless. Also, capabilities are irrelevant to the types of hack being discussed on this thread…
Capabilities are magic, if you don't have them. People confuse permission flags, such as those found in smartphones, etc.. or locking down permissions a-prior as in app-armor, with capabilities. The ability, at run time, to pick a file, and give only that file, folder, or set of resources to a piece of software is essential to secure computing. As far as I know, NeXT/macOS/iOS et all don't have that ability.
Try this experiment:
1. Write a macOS app that has a button which uses the file open window to load a document.
2. Enable the app sandbox by adding the relevant entitlement.
3. Prove to yourself it works by adding some code that directly fopen()s a file in your home directory and watching it fail.
4. Open that file by clicking the button and selecting it in the open dialog. Observe that you can now read it.
Or just go read Apple's documentation that explains their capabilities architecture in detail. Look for docs on sandbox extensions and Mach ports.
Re: Microsoft is a national security threat: ex-White House cyber policy director
#207Earlier quoted context omitted.
Wine can run apps that access hardware without issues. The main problem is the catch-22: there's not much point in developing competitors to Microsoft's stack if businesses aren't going to ever consider them, and government departments won't consider alternatives if they can't get everything from a single vendor in a 100% risk free manner thanks to the "nobody ever got fired for buying Microsoft" and "one throat to c…
> Wine can run apps that access hardware without issues. Depends on the hardware. Stuff like mice, keyboards or game controllers yes, as long as they're supported by the host OS stack (don't get me started on bluez and the clusterfuck that's Linux audio in general). But anything dealing with user-mode USB drivers (looking at you Samsung ODIN or a truckload of webcams) or more exotic hardware is out of luck. > Governm…
I think that's maybe more due to lack of demand/effort than any fundamental technical limitation. You can run USB drivers in user mode on both Linux and Windows. If someone paid enough for such support to be added, it'd appear.
A lot of the software getting hacked isn't even truly Windows-specific stuff to begin with though. VPN appliances, firewalls, they're probably all running out of date Linux distros. Active Directory servers could have some open source competitor too, aren't they mostly Kerberos? And for the rest, ChromeOS could knock it off too with a mix of web apps and RDP.
Re: Microsoft is a national security threat: ex-White House cyber policy director
#208Earlier quoted context omitted.
> The right answer here is if the situation is that bad, make a very public long-term commitment to shift to something else & up-level your IT department to be able to execute multi-year projects competently. The problem is that there isn't much in terms of alternatives, especially not if you prefer to have one software / vendor / tech stack. - In groupware, there used to be Lotus Notes, but that went down the drain…
>Thunderbird can do everything Outlook can (i.e. provide an email client, calendar and address book), but there is no official(ly supported) Thunderbird server software suite so there's always a potential for subtle bugs between whatever one chooses for directory, email and calendar backends. Thunderbird is a lot more reliable than outlook - I use both daily. But yeah there's no 'thunderbird software suite'. I don't…
> But yeah there's no 'thunderbird software suite'. I don't think that's really an issue though.
For me, it is. Outlook natively integrates with Teams, Onedrive and the rest of the Office suite. Everything is available at once, with one click, in a reasonably similar UX/UI pattern (okay, outside of the horror that is Teams with direct chats, meeting chats and Teams team chats). Let's just take a Teams meeting invite... in Outlook it directly opens the Teams meeting, in Thunderbird first the web browser pops up, which then opens Teams, and leaves a stray tab behind. It may be just ten seconds, but it's so much more annoying.
Re: Microsoft is a national security threat: ex-White House cyber policy director
#209Earlier quoted context omitted.
> Wine can run apps that access hardware without issues. Depends on the hardware. Stuff like mice, keyboards or game controllers yes, as long as they're supported by the host OS stack (don't get me started on bluez and the clusterfuck that's Linux audio in general). But anything dealing with user-mode USB drivers (looking at you Samsung ODIN or a truckload of webcams) or more exotic hardware is out of luck. > Governm…
I think that's maybe more due to lack of demand/effort than any fundamental technical limitation. You can run USB drivers in user mode on both Linux and Windows. If someone paid enough for such support to be added, it'd appear. A lot of the software getting hacked isn't even truly Windows-specific stuff to begin with though. VPN appliances, firewalls, they're probably all running out of date Linux distros. Active Dir…
> You can run USB drivers in user mode on both Linux and Windows.
Yeah, but you'd need to rewrite the whole Windows app for a native Linux or macOS port because WINE to my knowledge can't access devices even if there were a Linux/macOS driver.
> Active Directory servers could have some open source competitor too, aren't they mostly Kerberos?
AD is so much more than just LDAP+Kerberos. You have a fully integrated file store, native and direct integration into Exchange (on-prem and cloud), group policies for users and machines, DNS, DHCP, NTP... one vendor, one tech stack, one management way. Set it up and you're done, and even a novice can set up a minimal working small-business environment in a day.
With Linux, you have to integrate/configure Samba (LDAP, GPO, file storage), Heimdall/MIT Kerberos, postfix/exim (Mail), no idea what one could even use for calendar sync, BIND (DNS), ISC DHCP server, Jitsi (Video calls), Mattermost (Teams chats). Each of these software pieces have their own configuration syntax, nothing integrates automatically on its own, guides are sometimes horribly outdated, there's subtle differences in behavior between distributions, some of these tools have web UIs for management, others are CLI, and all of them look and behave differently.
Re: Microsoft is a national security threat: ex-White House cyber policy director
#210Earlier quoted context omitted.
GPL is one kind of open source, not all. That’s why I specified OSI. For government work, I care about OSI, not if people can just see and not legally change, contribute, and redistribute. I think government should fund global goods and want to be precise in my language. So when I say “open source” I specifically mean OSI-licensed stuff.
I specifically said "and other licenses", so why would you respond, as if I acted as if GPL was the only license? No matter. One entity doesn't get to unilaterally redefine a century old term. You claim you want precision, well then specify OSI, a subset of open source. (And yes, the licenses it approves are indeed a subset.)
One entity is the de facto organization that I, and many others trust to shepard this important definition for society.
Using precise language is useful for building software (and in general life).
I like that OSI exists and helps people understand a specific and desired definition for open source.
There’s a lot of thought on this topic by really smart and skilled people. The aspects of open source that I think are most important are captured in OSI.
For me, I don’t care if I can see the source, if it’s not free and usable. I can decompile code and patch for myself without a license. And I can pay for code in escrow.
But what’s important is that I can modify and redistribute. And that I can be part of a virtuous community creating things together.