Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Chose Profit over Security, Whistleblower Says

propublica.org

Post reply on HN
Print view View original

291–300 of 318 posts

Re: Microsoft Chose Profit over Security, Whistleblower Says

#291

Post by manquer »

halfcat wrote: post #277
manquer wrote: post #257

Earlier quoted context omitted.

There is nothing wrong with processes per se, From civil engineering to automotive to aviation there is a tangible outcome to all the laborious audits and paperwork. These systems are lot safer after regulations were put in place however onerous and ineffective they seem

What would this even look like in software? I always wonder if software is different than physical construction, or if software is just less mature of a discipline. In software, we can’t estimate projects accurately and consistently. We have to build a few to throw away just to get a better (yet still incomplete) picture of the problem we’re trying to solve. Imagine if the people building your house had to build half…

Correctness checking in software already exists for mission critical applications and is seen in sectors like spacecraft or avionics and to a degree in core finance etc.

Development in those fields are lot slower and very conservative and is by no means perfect, it is matter of culture and regulation and what you are ready to spend .

Project management challenges should not be conflated with product quality. Take JWST, a notoriously hard project to manage costs or timelines, but their product quality was perfect, if we can launch a telescope like that accurately the first time we can build software well, if we can afford it.

> Imagine if the people building your house had to build half of it and then start over. Maybe twice.

No need to imagine, I have seen people do that all the time, if you have the money you can afford endless remodeling and some people actually do that.

It all comes down to appetite to spend on good quality and culture to do so, in the era of low/no/AI code or off-shoring before that, there is constant downward pressure on costs, quality and security are the trade-offs.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#292

Post by raxxorraxor »

shortsunblack wrote: post #216

The solution is complete zero trust and distrusting the network in organizations. You should treat the internal network as external -- hostile. Google does this. They were the first ones to widely adopt zero trust with BeyondCorp and there has not been a Google internal organizational breach since Aurora (which made them adopt BeyondCorp, what they call zero trust). You have completely managed endpoints, strong harde…

That is a bit hypocritical of Google though since they do have scanned mails of their users for example. In that way they certainly did implement zero trust, but maybe here it has another meaning.

And I don't think such an architecture fits every company. Most (non-software) tech companies suffer under simple social engineering, scam mails and giving third parties their credentials. A threat is also economic espionage in all its forms.

Google certainly has other security concerns as well. Internal whistleblowers and maybe activist circles that run counter to the vision of management. For these problems their architecture might make sense, but it doesn't mean every company has the same threat vectors.

Of course security problems can be solved, but the infrastructure needed isn't trivial and many software stacks for engineering just don't allow for third party auth anyway.

Many developers (software or not) also shudder about their "managed endpoints". Works for Google obviously, but they are a special case here.

Much more effective here is sensible network segmentation. You don't need fancy auth services for that, just classic IT with a little sense for real threats. "Everything facing the internet" certainly is a very specific strategy that cannot be generalized.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#293

Post by 1oooqooq »

aaomidi wrote: post #218
1oooqooq wrote: post #184

Earlier quoted context omitted.

go make a cost analysis of crawling the entire internet once or twice a day on http vs https and report back

lol are you claiming that https is done to make web crawling more expensive? Wild.

the most pressing to google at the time was telecom abusing monopoly of mistyped urls to dictate search engine of their choice. but that too.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#294

Post by naikrovek »

throwaway610 wrote: post #185
naikrovek wrote: post #165

Earlier quoted context omitted.

Sheesh you guys are annoying. - I do not see ads in “every nook and corner of Windows” and neither do you. - I do not have a recorder installed on my Windows machines and neither do you. - no one qualified to make that statement has said that Microsoft is the most secure platform. It is so hard to listen to anyone who exaggerates at this level. If anything, it drives interest in Microsoft because these are all obviou…

Hey Jer, please review the CELA policy about disclosing your employment connection to Microsoft.

I don’t work for Microsoft, and I never have.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#295

Post by artjomb »

MattSteelblade wrote: post #141

So...Golden SAML isn't a vulnerability, as the CyberArk article quoted in the post reiterates, it's a type of attack that requires completely comprising the box before using. Unless I am misunderstanding something, I don't see any particular flaw, per se. As Microsoft (mocked in the article) would say, it's not crossing a security boundary. SSO will ALWAYS have this particular tradeoff. If your SSO infrastructure is…

Exactly! AD FS is part of Tier 0 in the same way as Active Directory itself and needs to be treated and secured as such. Of course, security goes a long way when it's part of a holistic approach like zero trust.

Mitigation is also not really possible when using SSO. One way would be to require the target service to require a second factor in addition to a valid SAML token, but then each user needs to keep current its second factor, whatever it might be, in each target service. This get unmanageable quite quick not to mention that there are basically no SaaS or self-hosted applications out there that support SSO and a second factor at the same time.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#296

Post by michaelcampbell »

JohnMakin wrote: post #73

The misaligned incentives between security and profit, especially in public companies, is not really a fixable problem without a massive cultural shift. I'm not sure at this point what could even trigger one. I've always dabbled in cybersecurity, taking on the hat in various roles over the years but have refused to go full time into it due to what I have personally seen in the industry - an overwhelming focus on comp…

> The misaligned incentives between security and profit

Cynically, there is no incentive for security; there is ONLY profit. Security comes into play only where it can increase profit, it's a second order effect. (Of course, there are legal and regulatory pressures here for it as well.)

Re: Microsoft Chose Profit over Security, Whistleblower Says

#297

Post by josefresco »

josephcsible wrote: post #203
josefresco wrote: post #188

Earlier quoted context omitted.

You're getting downvoted for your tone most likely, but I agree with this statement: > - I do not see ads in “every nook and corner of Windows” and neither do you. As a professional "Windows user" logging 8+ hours a day on my PC, I see no ads. Unless you count "OneDrive" ads which in that case, would mean I see iCloud ads on my iPhone too. I'm fine with classifying these as ads, but I'm certainly not seeing them "in…

> Are these ads only bundled with a certain versions of Windows? Yes. Enterprise customers can get builds without them, but home users can't.

I'm running Windows 11 Home 23H2 22631.3737

No ads - like anywhere.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#298

Post by josefresco »

progmetaldev wrote: post #224
josefresco wrote: post #188

Earlier quoted context omitted.

You're getting downvoted for your tone most likely, but I agree with this statement: > - I do not see ads in “every nook and corner of Windows” and neither do you. As a professional "Windows user" logging 8+ hours a day on my PC, I see no ads. Unless you count "OneDrive" ads which in that case, would mean I see iCloud ads on my iPhone too. I'm fine with classifying these as ads, but I'm certainly not seeing them "in…

I don't get ads in Windows 10 or 11 Pro. I don't think you need Enterprise. When I first install Windows, I turn off every single feature that you're presented with (advertising ID, the ink workspace/writing recognition, safe search suggestions in the browser, etc.) and I haven't had any ads pop up on me (or software installed that I didn't specifically install myself). I turn off Cortana and don't use it, I have the…

Same thing here, and I'm running Home (22631.3737). I turn most "things" off, but nothing insane and I don't see any ads.

Re: Microsoft Chose Profit over Security, Whistleblower Says

#300

Post by HotPotato787 »

MattSteelblade wrote: post #141

So...Golden SAML isn't a vulnerability, as the CyberArk article quoted in the post reiterates, it's a type of attack that requires completely comprising the box before using. Unless I am misunderstanding something, I don't see any particular flaw, per se. As Microsoft (mocked in the article) would say, it's not crossing a security boundary. SSO will ALWAYS have this particular tradeoff. If your SSO infrastructure is…

Yes, that's what I understood too. The article seems to exaggerate some points, and this is one of them.

It's like creating an attack called "GOLDEN ADMIN". If you have admin credentials, you can log in as the admin and do anything you want! Wow!

(I know that letting attackers authenticate to anywhere without generating logs is bad, but still... i agree with the parent reply)

Post reply on HN