Microsoft Chose Profit over Security, Whistleblower Says • Hacker News Board

Re: Microsoft Chose Profit over Security, Whistleblower Says

#11

Post by diggan » Thu, Jun 13, 2024, 1:34 PM UTC

1vuio0pswjnm7 wrote: post #2

Sounds like the same Microsoft culture as has always been. Like a cult. It can do no wrong. The conversation with Microsoft businesspeople at conferences was always the same: Microsoft has no deficiencies, there is nothing it isn't working on and it has a solution for every possible problem. Other sources of software do not exist. There is only Microsoft. Total illusion put forth by delusional employees. The outside…

To be honest, that sounds like every company that suffers from delusions of grandeur and wants to conquer the planet, one way or another.

What you're saying is equally true for Apple, Google, Amazon and most other public companies today. You're never gonna get "Use this Microsoft product" as an answer from Apple support/engineer even if that product would solve your particular problem better.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#12

Post by NekkoDroid » Thu, Jun 13, 2024, 1:35 PM UTC

diggan wrote: post #8

eganist wrote: post #5

Earlier quoted context omitted.

If memory over the last two decades serves, this is a relatively recent degradation. Microsoft's security reputation prior to the recent (5ish years?) failures was largely built up on top of the work stemming from the Trustworthy Computing memo. https://www.wired.com/2002/01/bill-gates-trustworthy-computi...

Bill Gates in 2002: "So now, when we face a choice between adding features and resolving security issues, we need to choose security." Satya Nadella in 2024: "If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security." Microsoft in 2024: Run this software on your computer so we can take a screenshot of everything you do, index it and we promise Security is still, and h…

> And yes, we do store data unencrypted on your disk, why are you asking?

But don't worry, you need to be an administrator to open the file. What? your average person daily drives an administrator account? How should we have known that???

Re: Microsoft Chose Profit over Security, Whistleblower Says

#13

Post by diggan » Thu, Jun 13, 2024, 1:37 PM UTC

everdrive wrote: post #9

I'm not defender of Microsoft, but I don't know if I could point to any company which does not put profit over security.

I guess the issue becomes when they say security is the top priority (and have been for two decades), yet all actions point towards it not being so.

> Bill Gates in 2002: "So now, when we face a choice between adding features and resolving security issues, we need to choose security."

https://www.wired.com/2002/01/bill-gates-trustworthy-computi...

> Satya Nadella in 2024: "If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security."

https://www.theverge.com/24148033/satya-nadella-microsoft-se...

Re: Microsoft Chose Profit over Security, Whistleblower Says

#14

Post by freedomben » Thu, Jun 13, 2024, 1:40 PM UTC

NekkoDroid wrote: post #6

Drakim wrote: post #4

Earlier quoted context omitted.

Don't worry, Microsoft has big ambitions and huge plans about how to truly present themselves as more safety oriented in the future.

AI Safety. Code is run through AI to check for vulnerabilities. Files are analyzed by AI to ensure they aren't malware. Every instruction is run through AI to ensure nothing maliciously is happening (mostly enforcing DRM :). Every pixel is output by AI to ensure you see nothing not intended for your precious eyes.

You joke, but (the DRM part at least) is the future I fear is coming. It could hit us from so many angles (not forgetting Chrome's Web Environment Integrity and Apple's Private Access Tokens), and with all the money and power behind it (big tech plus big copyright), and the complete apathy of the average user towards this, it seems inevitable.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#15

Post by ls65536 » Thu, Jun 13, 2024, 1:47 PM UTC

everdrive wrote: post #9

I'm not defender of Microsoft, but I don't know if I could point to any company which does not put profit over security.

I'm sure there are some companies that realise security (or rather the critical lack of some important aspect of it) can impact profits, but that depends a lot on who their customers are too. Ultimately, if the customers who pay for a vendor's products and services don't value it, then the vendors won't value it either, short of any regulatory or legal requirements that might compel them otherwise. However, given that many large organizations (including governments) are Microsoft customers, it's strange to see in this case. Maybe there's a kind of "it can't happen to us" or "nobody will find out about it" arrogance going on, but they must now be seeing that the reputational damage is likely to have negative impacts, including hurting future profits, down the road.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#16

Post by drpossum » Thu, Jun 13, 2024, 1:51 PM UTC

everdrive wrote: post #9

I'm not defender of Microsoft, but I don't know if I could point to any company which does not put profit over security.

I genuinely think Proton as a company would prefer to cease to exist rather than offer insecure products. In fact there's a lot of offerings I would use (and pay more for) and they could make but choose not to (like a calendar that is not over an airtight protocol and could integrate with my regular calendar clients).

Re: Microsoft Chose Profit over Security, Whistleblower Says

#17

Post by ls65536 » Thu, Jun 13, 2024, 1:54 PM UTC

diggan wrote: post #13

everdrive wrote: post #9

I'm not defender of Microsoft, but I don't know if I could point to any company which does not put profit over security.

I guess the issue becomes when they say security is the top priority (and have been for two decades), yet all actions point towards it not being so. > Bill Gates in 2002: "So now, when we face a choice between adding features and resolving security issues, we need to choose security." https://www.wired.com/2002/01/bill-gates-trustworthy-computi... > Satya Nadella in 2024: "If you’re faced with the tradeoff between se…

Obviously, nobody is going to outright admit they put profits above security; indeed, they will often state the opposite. But their closely-held beliefs will shine through when it comes time to make decisions and the outcomes of those decisions are exposed to their customers and to the public.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#18

Post by NekkoDroid » Thu, Jun 13, 2024, 1:56 PM UTC

freedomben wrote: post #14

NekkoDroid wrote: post #6

Earlier quoted context omitted.

AI Safety. Code is run through AI to check for vulnerabilities. Files are analyzed by AI to ensure they aren't malware. Every instruction is run through AI to ensure nothing maliciously is happening (mostly enforcing DRM :). Every pixel is output by AI to ensure you see nothing not intended for your precious eyes.

You joke, but (the DRM part at least) is the future I fear is coming. It could hit us from so many angles (not forgetting Chrome's Web Environment Integrity and Apple's Private Access Tokens), and with all the money and power behind it (big tech plus big copyright), and the complete apathy of the average user towards this, it seems inevitable.

The DRM part wasn't really part of the joke, just a sad truth that is being worked on more and more that sadly fit into the joke.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#19

Post by ziddoap » Thu, Jun 13, 2024, 2:16 PM UTC

diggan wrote: post #13

everdrive wrote: post #9

I'm not defender of Microsoft, but I don't know if I could point to any company which does not put profit over security.

I guess the issue becomes when they say security is the top priority (and have been for two decades), yet all actions point towards it not being so. > Bill Gates in 2002: "So now, when we face a choice between adding features and resolving security issues, we need to choose security." https://www.wired.com/2002/01/bill-gates-trustworthy-computi... > Satya Nadella in 2024: "If you’re faced with the tradeoff between se…

Profit is an implicitly assumed first priority for basically every business, otherwise the business wouldn't be around.

I don't know of any company that has profit in their slogan, or in the core values statement, etc.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#20

Post by LightHugger » Thu, Jun 13, 2024, 2:23 PM UTC

everdrive wrote: post #9

I'm not defender of Microsoft, but I don't know if I could point to any company which does not put profit over security.

They are rare, but Mullvad comes to mind immediately. They have made several decisions that directly impacted their bottom line (no recurring subscriptions where they need to keep the customer's credit card on file) to the benefit of their customer's security.