Microsoft Teams: 1 feature, 4 vulnerabilities • Hacker News Board

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#21

Post by mschuster91 » Wed, Dec 22, 2021, 10:52 AM UTC

xvector wrote: post #2

What is the solution? More security education for general SWEs? It seems like whatever team worked on this feature never considered any security perspectives.

> It seems like whatever team worked on this feature never considered any security perspectives.

The solution is simple: similar in thought to GDPR, make vendors of proprietary products above a certain size (e.g. market share, net worth, # of employees) liable for security issues even if they do not result in privacy breaches.

Vendors will then either have to release their software as open source or need to carry insurance for security issues, and the insurance companies will only provide insurance if company processes are following industry standards - e.g. code reviews, security audits during concept and development, appropriate staffing of developer teams or requiring certifications/training for developers.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#22

Post by cloudengineer94 » Wed, Dec 22, 2021, 10:54 AM UTC

smcleod wrote: post #20

cloudengineer94 wrote: post #18

Earlier quoted context omitted.

I know right? Plus MS Teams is the among the most used apps in the enterprise world how come the only good version of it is only available in Windows 11 where most workplaces aren't even pushing it to their users. The way Microsoft handles Teams annoys the crap out of me the MacOS and Linux versions are left to die basically.

It is (by far) the most horrific piece of software I'm forced to used, the UI/UX is confusing, it's a battery killer, eats all the ram (though - that's common with all electron garbage), it somehow manages to make Bluetooth headsets drop out, it significantly impacts network performance when sharing video, a lot of bugs in the calendaring system.... I could go on, but damn I just hate it.

When I used to have my i9 16" MBP, the thing would go crazy and hit 90% CPU usage during web calls on Teams.

I had to force myself to have it in clamshell mode to avoid crazy stuff going on.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#23

Post by JumpCrisscross » Wed, Dec 22, 2021, 10:54 AM UTC

pydry wrote: post #17

In 2020 a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft led to a company-wide prohibition on using anything other than Teams "for security reasons" where i worked. This was, I am almost certain, inspired by Microsoft corporate sales getting their hooks into management. This was largely because of news stories like "end to end encryption doesnt really work as advertised" and "if you leav…

> a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft

Zoom had and continues to have a significant developer presence in China. Those individuals are subject to CCP coercion. There was also a time when they routed American calls through the mainland [1]. That has been fixed. But it remains excessive to cast all past criticism of Zoom as Microsoft's work.

[1] https://techcrunch.com/2020/04/03/zoom-calls-routed-china/

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#24

Post by mschuster91 » Wed, Dec 22, 2021, 10:54 AM UTC

brnt wrote: post #5

xvector wrote: post #2

What is the solution? More security education for general SWEs? It seems like whatever team worked on this feature never considered any security perspectives.

There is a reason that in construction, the architect and the structural engineer are separate roles. From what I've seen in software dev, it cannot be considered engineering until a similar division is normalized, mandated and legally required. It's easy to shove things into production, too easy.

Software engineering does have the profession of "software architects" in theory, the problem is that the only thing they get taught in academia is building useless object models for Java.

(Side rant, the fact that academic computer science is so far away from real life is yet another can of worms)

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#25

Post by pid-1 » Wed, Dec 22, 2021, 10:54 AM UTC

xvector wrote: post #2

What is the solution? More security education for general SWEs? It seems like whatever team worked on this feature never considered any security perspectives.

I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need).

I have no security education, but I care about stuff because I will be held responsible if we get pwned at some point.

IMO the biggest issue is that SWEs very rarely have long term skin in the game in the projects they are committing to.

Many have strong incentives to not care about security, day 2 ops, etc... When shit hits the fan bonuses were already paid and said professionals often moved on.

I think that tends to be lessened by having small projects with clear owners that don't jump around all the time. Companies with smaller turnover win big here.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#26

Post by xxs » Wed, Dec 22, 2021, 10:55 AM UTC

m_mueller wrote: post #14

I have a hard time understanding why MS is investing so much into VS Code yet so little progress is made on MS Teams (which in theory should be more important to them as it has broader usage?).

how do you know they are not 'investing'. It's my firm belief that even if Microsoft did try as hard as they could and they would assemble a whole teams to try and design/implement a worse product than "Teams"... that would be a spectacular failure.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#27

Post by _kbh_ » Wed, Dec 22, 2021, 10:55 AM UTC

cloudengineer94 wrote: post #9

Still waiting for these guys to update their MacOS app, we use it in our company and it's so bad that our own team uses Slack.

I'm still reeling from the fact that the macOS teams app have a local privilege escalation to root vulnerability for a while. Why does ANY part of teams run as root?.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#28

Post by winter_squirrel » Wed, Dec 22, 2021, 10:57 AM UTC

pydry wrote: post #17

In 2020 a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft led to a company-wide prohibition on using anything other than Teams "for security reasons" where i worked. This was, I am almost certain, inspired by Microsoft corporate sales getting their hooks into management. This was largely because of news stories like "end to end encryption doesnt really work as advertised" and "if you leav…

> I'm almost certain was driven by Microsoft

Would you happen to have any actual evidence to back this up with?

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#29

Post by drcongo » Wed, Dec 22, 2021, 10:57 AM UTC

cloudengineer94 wrote: post #9

Still waiting for these guys to update their MacOS app, we use it in our company and it's so bad that our own team uses Slack.

I had to install Teams for my kids' pandemic schooling. Now, I'm not a stupid man, but Teams makes me feel like one. It's without a doubt the most baffling piece of software I've ever tried to use - teachers post things for the kids to do at home and it takes forever to actually find them as there's so many different places they can be. I presume the goal in creating this app was "we need to compete with Slack", but then various teams inside Microsoft must have gotten very territorial during the design phase and now we have this monstrosity, not fit for any purpose at all let alone competing with Slack.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#30

Post by ssdspoimdsjvv » Wed, Dec 22, 2021, 10:57 AM UTC

emerongi wrote: post #12

baq wrote: post #4

Earlier quoted context omitted.

great way to not have any software released ever

Somehow we still have medicine (they do a lot of testing before they release anything!) and doctors (they have insurance!). It would increase the barrier to releasing software massively (possibly killing the startup scene altogether), but it doesn't mean software development would end.

If we applied the same rigorous testing and verification processes in medicine to software, software development as we know it would definitely end. It would probably take years to convert a straight-forward requirement into a working piece of software. Something like Teams or VS Code that get new features added all the time would not be possible anymore and would cost tons of money. And while security issues should not be taken lightly, I don't consider leaking my user agent to be as big of a problem as getting permanent damage from low-quality medical care.