Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Copilot broke audit logs, but Microsoft won't tell customers

pistachioapp.com

Post reply on HN
Print view View original

61–70 of 324 posts

Re: Copilot broke audit logs, but Microsoft won't tell customers

#61

Post by beart »

ocdtrekkie wrote: post #43
jjkaczor wrote: post #35

Earlier quoted context omitted.

So... basically like when Delve was first introduced and was improperly security trimming things it was suggesting and search results. ... Or ... a very long-time ago, when SharePoint search would display results and synopsis's for search terms where a user couldn't open the document, but could see that it existed and could get a matching paragraph or two... Best example I would tell people of the problem was users s…

I would say "insecure by default". I talked to some Microsoft folks around the Windows Server 2025 launch, where they claimed they would be breaking more compatibility in the name of their Secure Future Initiative. But Server 2025 will load malicious ads on the Edge start screen[1] if you need to access a web interface of an internal thing from your domain controller, and they gleefully announced including winget, a…

I've always felt that Microsoft's biggest problem is the way it manages all of the different teams, departments, features, etc. They are completely disconnected and have competing KPIs. I imagine the edge advertising team has a goal to make so much revenue, and the security team has a goal to reduce CVEs, but never the twain shall meet.

Also you probably have to go up 10 levels of management before you reach a common person.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#62

Post by overgard »

I don’t know much about audit logs, but the more concerning thing to me is it sounds like it’s up to the program reading the file to register an access? Shouldn’t that be something at the file system level? I’m a bit baffled why this is a copilot bug instead of a file system bug unless copilot has special privileges? (Also to that: ick!)

Re: Copilot broke audit logs, but Microsoft won't tell customers

#63

Post by p_ing »

gpm wrote: post #60
Spooky23 wrote: post #57

Earlier quoted context omitted.

If there is a product defect? Sure. The dude found the bug, reported the bug, they fixed the bug. This isn’t uncommon, there bugs like this frequently in complex software.

I think you just defined away the entire category of vulnerability known as "privilege escalation".

This isn’t an example of escalation. Copilot is using the user’s token similar to any other OAuth app that needs to act on behalf of the user.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#64

Post by IcyWindows »

overgard wrote: post #62

I don’t know much about audit logs, but the more concerning thing to me is it sounds like it’s up to the program reading the file to register an access? Shouldn’t that be something at the file system level? I’m a bit baffled why this is a copilot bug instead of a file system bug unless copilot has special privileges? (Also to that: ick!)

I suspect this might be typical RAG where there is a vector index or chucked data it looks at.

Re: Copilot broke audit logs, but Microsoft won't tell customers

#65

Post by AdieuToLogic »

TheRoque wrote: post #49

In my opinion, using AI tools for programming at the moment, unless in a sandboxed environment and on a toy project, is just ludicrous. The amount of shady things going on in this domain (AI trained on stolen content, no proper attribution, not proper way to audit what's going out to third party servers etc.) should be a huge red flag for any professional developer.

> In my opinion, using AI tools for programming at the moment, unless in a sandboxed environment and on a toy project, is just ludicrous.

Well put.

The fundamental flaw is in trying to employ nondeterministic content generation based on statistical relevance defined by an unknown training data set, which is what commercial LLM offerings are, in an effort to repeatably produce content satisfying a strict mathematical model (program source code).

Re: Copilot broke audit logs, but Microsoft won't tell customers

#66

Post by fragmede »

keyle wrote: post #20
heywire wrote: post #9

I am so tired of Microsoft cramming Copilot into everything. Search at $dayjob is completely borked right now. It shows a page of results, but the immediately pops up some warning dialog you cannot dismiss that Copilot can’t access some file “” or something. Every VSCode update I feel like I have to turn off Copilot in some new way. And now apparently it’ll be added to Excel as well. Thankfully I don’t have to use an…

Everything except the best thing they could have brought back: Clippy! </3

So Louis Rossmann put out a YouTube video encouraging internet users to change their profile pictures to an image of Clippy, as a form of silent protest against unethical conduct by technology companies, so it's making a comeback!

Re: Copilot broke audit logs, but Microsoft won't tell customers

#68

Post by p_ing »

troad wrote: post #44

Microsoft's ham-fisted strategy for trying to build a moat around its AI offering, by shoving everyone's documents in it without any real informed consent, genuinely beggars belief. It will not successfully create a moat - turns out files are portable - but it will successfully peeve a huge number of users and institutions off, and inevitably cause years of litigation and regulatory attention. Are there no adults lef…

Copilot pulls from the substrate, like many other apps. No files are store in Copilot. They’re usually on ODSP but could be in Dataverse or a non-Microsoft product like Confluence (there goes your moat!).

Re: Copilot broke audit logs, but Microsoft won't tell customers

#69

Post by waffleiron »

Spooky23 wrote: post #33
QuadmasterXLII wrote: post #18

This seems like a five alarm fire for HIPPA, is there something I’m missing?

It’s a bug. He reported it, they fixed it. It is not a five alarm fire for HIPAA. HIPAA doesn’t require that all file access be logged at all. HIPAA also doesn’t require that a CVE be created for each defect in a product. End of the day, it’s a hand-wavy, “look at me” security blog. Don’t get too crazy.

I am more on the privacy side of things like HIPAA, but I would like to link the following.

https://www.hhs.gov/sites/default/files/january-2017-cyber-n...

Post reply on HN