Microsoft Teams: 1 feature, 4 vulnerabilities • Hacker News Board

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#171

Post by jdmichal » Wed, Dec 22, 2021, 1:22 PM UTC

blahblah12 wrote: post #104

Reading through these vulnerabilities, it feels like a handful of these are low priority or non-issues. This might be a controversial opinion, but it’s not clear to me why these issues ought to be prioritized and fixed expediently. For example, it’s not clear to me why an IP address leak is considered problematic. And breaking chat or crashing on reload seems more akin to a bug a la iMessage link bugs like https://ww…

The IP leak one is really interesting to me. Considering the quip regarding the fact that centralized servers are performing the link preview operation because it's not using E2E encryption... But if it was, and the client machine was generating the preview, then wouldn't that force exposure of the client's IP to the remote server?

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#172

Post by einszwei » Wed, Dec 22, 2021, 1:22 PM UTC

ClumsyPilot wrote: post #123

JumpCrisscross wrote: post #23

Earlier quoted context omitted.

> a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft Zoom had and continues to have a significant developer presence in China. Those individuals are subject to CCP coercion. There was also a time when they routed American calls through the mainland [1]. That has been fixed. But it remains excessive to cast all past criticism of Zoom as Microsoft's work. [1] https://techcrunch.com/2020/04/0…

"Zoom had and continues to have a significant developer presence in China." So whats worse: a backdoor for China, or a giant hole for anyone interested? I guess the latter gives us esual opportunity...

One of them can be fixed with a software update.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#173

Post by zerocount » Wed, Dec 22, 2021, 1:23 PM UTC

rob74 wrote: post #94

pydry wrote: post #17

In 2020 a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft led to a company-wide prohibition on using anything other than Teams "for security reasons" where i worked. This was, I am almost certain, inspired by Microsoft corporate sales getting their hooks into management. This was largely because of news stories like "end to end encryption doesnt really work as advertised" and "if you leav…

Honestly I fail to understand why Zoom seems to have so many fans. I find the UI confusing, on my Linux machine having a call with video will lead to the CPU cooler going into overdrive, I often have to leave and re-enter calls because audio output isn't working, etc. etc.

I thought it was the best I've used. It was very intuitive and I could easily test my mic and sound. It handled my 5mb hotspot connection without stuttering. Contrast that to Teams: Desktop or web version? One allows anonymous use, the other doesn't. You have to Google to find out how to test mic and sound, which brings up the desktop version. I was using the web version and ran out of time for searching. The video would freeze every 30 seconds or so.

Zoom did it right and that's why it's popular.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#174

Post by Arwill » Wed, Dec 22, 2021, 1:26 PM UTC

imglorp wrote: post #133

2ion wrote: post #33

Earlier quoted context omitted.

Even a very large amount of data pasted should not blow up a text box in 2021. I mean, on Windows you can paste an object referring to a data blob pretty sure, macOS surely has something similar and on X/Wayland you could sniff and size of data pasted in advance and do something useful. If it's plain text like JSON even 5G of plain text should not bring a text box to its knees when the memory is available, it's not b…

Slack handles it cleanly. It tells you the paste is too large and tells you how to add an attachment instead.

That is the difference of specialised software in comparison to duct-taped solution like Teams. The first one has code to decide what is meaningful for the user in a given context, the second "just renders" the whole thing and show the user a thumbnail, probably without even knowing what kind of content it is dealing with.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#175

Post by paulcole » Wed, Dec 22, 2021, 1:27 PM UTC

blahblah12 wrote: post #168

paulcole wrote: post #139

Earlier quoted context omitted.

> At MS some department (marketing, sales, product managers, devs?) somehow coordinated a bunch of press leaks (not sure how these were even determined to be 'leaks'), made sure that media outlets collectively believed that they were problematic, and then used those leaks to influence sales? You’re literally describing a thing that exists which is called public relations. I’ll admit it is unlikely for the call to be…

So we’re suggesting a 3rd-party PR firm likely coordinated public criticism about Zoom, an app that was undergoing hyper growth and entered the public consciousness in 2020 due to WFH and COVID. We don’t think media outlets would likely have wanted to voraciously cover Zoom stories because Zoom became one of the most widely used apps out of nowhere? The logic appears to be: I saw a lot of news stories about X, theref…

I was more making the point that you seemed unaware of the concept of public relations and instead thought that Microsoft developers would take the initiative to sow the seeds of Zoom discontent themselves.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#176

Post by 542458 » Wed, Dec 22, 2021, 1:29 PM UTC

isodev wrote: post #116

I work with several large organisations, all using Teams. In every instance, the previous solution (Slack/Zoom/Discord) was replaced by Teams following higher management making the switch for reasons like "it's included in Office 365" or a new hire influencing the migration to Microsoft solutions. In every instance, the application was/is not well received by the employees - it's slow, buggy, crazy complicated and ge…

Anecdotally (as a counterpoint), we also went with teams, and it’s been… fine. There are bugs, but they’re mostly in the category of “irritating” rather than “massively disruptive”. It’s nice that teams is integrated with the rest of Microsoft’s 365 and outlook stuff, and service uptime has been good enough. From my POV, the differences vs Slack have been pretty minor (although I recognize that my experience isn’t universal).

That said, yeah, leaving vulns and/or the irritating bugs open for as long as they have is silly.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#177

Post by yc-kraln » Wed, Dec 22, 2021, 1:31 PM UTC

IiydAbITMvJkqKf wrote: post #34

MS Teams is the worst software I've ever used. This is not hyperbole. A room full of monkeys on a typewriter would never create something as bad as teams.

YMMV, for my use cases it seems to work really well. I wonder if your instance has been heavily "customized" with group policy, or something.

Given the alternative for us would be slack+zoom+gsuite, which all have impressively daunting privacy concerns as well as pretty crappy usability themselves, I (and the people I am collaborating with regularly) am really happy with Teams.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#178

Post by klhugo » Wed, Dec 22, 2021, 1:34 PM UTC

I hope somebody at Microsoft read this. It goes far beyond security vulnerabilities. The Teams Linux client is barely usable. Chromebooks don't even have a client.

Could Microsoft expose an API and allow third party clients to be developed?

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#179

Post by nullymcnull » Wed, Dec 22, 2021, 1:37 PM UTC

No surprise at the MS non-response here. Anyone forced to use Teams every day can see that it's being maintained by a skeleton crew (at best) on the dev side. Every single day I miss basic features (like global message linkability) that I came to love in Slack, and suffer 101 little bugs and annoyances that never seem to improve much.

MS clearly thinks Teams is "good enough" - enough of the feature checkboxes ticked that they can focus mostly on aggressively marketing it, making it seem crazy to use a separate third-party chat platform instead of Teams if you're using Azure.. even if does happen to be a buggy bloated beast, with almost unusably wretched mobile apps.

If there's just one area I wish we hadn't switched to MS-brand dogfood after making the move to Azure, it's chat/calling. It's a deceptively tricky domain to get it right in, and one where you really want as little friction as possible for all users.

"We should have stuck with Slack." - every team that ever switched to MS Teams.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#180

Post by perryizgr8 » Wed, Dec 22, 2021, 1:39 PM UTC

It is unbelievable the difference in development velocity and quality of the final product if you compare Teams and VS code, both from Microsoft. Both apps are built on electron.

Teams is dog slow, VS code is probably the fastest electron app in existence.

Teams is full of bugs, and it seems they are unwilling to fix even security vulns (from TFA). VS code is free of bugs, even though I use it way more than Teams.

Teams is not fixing even security bugs, and VS code's update cycle is so frequent that it is annoying. I am surprised how long their version notes are.

Really strange.