Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

washingtonpost.com

Post reply on HN
Print view View original

81–90 of 456 posts

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#81

Post by zanecodes »

alephnerd wrote: post #75
zanecodes wrote: post #72

Earlier quoted context omitted.

CrowdStrike is not made or owned by Microsoft.

Giving OP the benefit of the doubt, there were issues with how the Windows kernel had little guardrails and restrictions. That said, that was the EU's fault, as the EU in 2009 forced Microsoft to fully expose their OS internals to outside vendors during an anti-trust settlement, and with little ability to enforce vendor standards: ""Microsoft shall make available to interested undertakings Interoperability Informatio…

Well, I hate Microsoft as much as the next person, but I'm not sure "writing a buggy kernel module can crash the kernel" is much of an indictment of Windows in particular...

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#82

Post by alephnerd »

zanecodes wrote: post #81
alephnerd wrote: post #75

Earlier quoted context omitted.

Giving OP the benefit of the doubt, there were issues with how the Windows kernel had little guardrails and restrictions. That said, that was the EU's fault, as the EU in 2009 forced Microsoft to fully expose their OS internals to outside vendors during an anti-trust settlement, and with little ability to enforce vendor standards: ""Microsoft shall make available to interested undertakings Interoperability Informatio…

Well, I hate Microsoft as much as the next person, but I'm not sure "writing a buggy kernel module can crash the kernel" is much of an indictment of Windows in particular...

I agree with ya. Just playing devil's advocate.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#83

Post by fsflover »

sugarpimpdorsey wrote: post #52
SketchySeaBeast wrote: post #8

Earlier quoted context omitted.

Genuinely asking - is there a Linux alternative to Sharepoint? I couldn't care less if it was lit on metaphorical fire and dumped into the sea, but a lot of orgs using it extensively.

The same people will tell you GIMP is a serious competitor to Photoshop.

And it will be true for 99% of use cases.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#84

Post by kuhsaft »

tombert wrote: post #24

At the risk of massive downvotes, I have to admit that a small part of me wants this so that maybe corporations stop using Sharepoint as soon as possible. Seriously, I haven't used it since 2017, but every time I used it then it was the worst part of my day. I used to have a shirt that said SHarepoIT Happens that I would wear to work, and it seemed like the one thing I could get my coworkers agree on was that Sharepo…

It’s impossible to stop using M365 while stopping usage of SharePoint (cloud or on-premises). See https://news.ycombinator.com/item?id=44640219

Here’s just one example:

Each M365 Teams Team creates an M365 Group which creates a SharePoint site and Exchange mailbox. Teams channel files are stored in that SharePoint site. Teams channel messages are stored in the Exchange mailbox.

Private files dropped in Teams are stored in OneDrive (rebranded SharePoint). Private Teams messages are stored in the sender and recipients’ Exchange mailboxes.

M365 is SharePoint and Exchange. EVERYTHING is built on top.

EDIT: changed ‘individual’ to ‘sender and recipients’

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#85

Post by zelphirkalt »

alephnerd wrote: post #75
zanecodes wrote: post #72

Earlier quoted context omitted.

CrowdStrike is not made or owned by Microsoft.

Giving OP the benefit of the doubt, there were issues with how the Windows kernel had little guardrails and restrictions. That said, that was the EU's fault, as the EU in 2009 forced Microsoft to fully expose their OS internals to outside vendors during an anti-trust settlement, and with little ability to enforce vendor standards: ""Microsoft shall make available to interested undertakings Interoperability Informatio…

Security by obscurity is a bad security concept. If anything making that information available prevented things from lurking in there and doing even more damage.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#86

Post by ThinkBeat »

I have spent far too much of my life on SharePoint. Having it internet facing has never been a good idea. Not really what it is meant for, though the promo verbiage on that has changed over different versions.

Some folks wanted SharePoint as their "web server", I would set that installation up entirely separted from all other instances they may have on the network.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#87

Post by jauntywundrkind »

charles_f wrote: post #80

> CISA advises vulnerable organizations [...] to disconnect affected products from the public-facing Internet until an official patch is available. It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. I would have assumed a the Venn diagram of these organizations to be entirely contained in orgs forcing you to use a VPN.

Oh CISA...

What a pity that CISA has been purged down of effective useful people and turned into another sad selected-for-political-compliance-only force.

Arizona recently got attacked from Iranian hackers & didn't even bother trying to get help from CISA. https://archive.is/2025.07.19-143305/https://www.azcentral.c...

CISA is so so vital. Investigating incredibly wide ranging attacks like this, or the Salt Typhoon attack are vital for this nation. But the show is being run by a bunch of people who value political dogma far above anything else. https://www.techdirt.com/tag/cisa/

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#88

Post by rs186 »

tombert wrote: post #24

At the risk of massive downvotes, I have to admit that a small part of me wants this so that maybe corporations stop using Sharepoint as soon as possible. Seriously, I haven't used it since 2017, but every time I used it then it was the worst part of my day. I used to have a shirt that said SHarepoIT Happens that I would wear to work, and it seemed like the one thing I could get my coworkers agree on was that Sharepo…

My company has SharePoint and another internal site for documents/notes (think about Notion/Quip/Confluence). The other site works quite well, and most developers write all their notes/docs on it. But some people just insist on uploading Word documents to SharePoint. So now everybody else has to use SharePoint as well, plus search twice whenever they need to find something.

Re: Global hack on Microsoft Sharepoint hits U.S., state agencies, researchers say

#89

Post by Arainach »

charles_f wrote: post #80

> CISA advises vulnerable organizations [...] to disconnect affected products from the public-facing Internet until an official patch is available. It's interesting to me that you'd go the hassle of hosting your own SharePoint on prem, but leave it internet facing. I would have assumed a the Venn diagram of these organizations to be entirely contained in orgs forcing you to use a VPN.

Best practice is to assume the network is compromised - a VPN doesn't provide as much guarantee as people would like. In large fleets, devices are regularly lost, damaged, retired, etc. In organizations with high target value, physical penetration through any number of means should be assumed.

So you don't do that. You use zero trust and don't care that things are exposed to the internet.

Working from anywhere (remote sites, home, your phone) is a huge benefit. Organizations want to control their data entirely while still wanting their organization to be able to access it.

Post reply on HN