Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

csoonline.com

Post reply on HN
Print view View original

311–320 of 404 posts

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#311

Post by mindok »

croes wrote: post #287
kapone wrote: post #222

Earlier quoted context omitted.

It fills a niche. What’s else does? Yes, it’s not great, but so what?

How about using tools that do their job great instead of one tool that can do them all but none of them good. It tells the company values price more than capability. I asked in my company why we use SharePoint and the answer was name a better alternative. So I asked an better alternative to do what? I never got an answer.

If the objective is to put files where you can’t find them again, I think you’d be hard pressed to find a better alternative.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#312

Post by p_ing »

stackskipton wrote: post #116
necovek wrote: post #95

Earlier quoted context omitted.

I see you build a case for traditional MS product in Exchange, yet this issue is about Sharepoint. Just like with Windows, Microsoft has built a moat with Exchange, but the question is why do all the companies buy into their full ecosystem, especially for anything relating to web technologies (you even bring up Exchange Web Services), because this they do really badly, and Sharepoint seems to be the worst. However, I…

I used Exchange because it was what I most familiar with. SharePoint operates in similar matter with all sharding (though backend is still MSSQL with it's sharding last I checked) Sure, PostFix/DoveCot will scale if you are doing just email. Once you add GroupWare requirements, PostFix/Dovecot are no longer in same boat.

SharePoint does not use [SQL] sharding. Each Site Collection is contained within a single Content [SQL] database. However the blobs themselves can be stored elsewhere via a provider, out of the box a file system provider is available (in SPO they use Azure Blob Storage).

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#313

Post by p_ing »

bawolff wrote: post #262
stackskipton wrote: post #75

As usual with all these types of posts, people go "HA HA, MICRO$OFT SUCKS" without understanding business practices that keep them afloat. Don't use Exchange? Cool, what should we use instead? Does it support 15 people all the way up to 150000 people? I used to run Exchange cluster for 70k people, is there other mail software out there complete with non-shared disk redundancy? Where the users connect to single endpoi…

> Sharepoint with another 2 RCEs. Not shocked, the software is terrible. However, it's only software that will stand up under load and let us shard it easily. All open-source software is one of those, runs fine in Homelab, likely falls down under load. Few Open Source Developers want to work on this stuff which I get because it's tedious work interfacing with computer illiterate end users. I'd rather chug sewage then…

No, but storing files is one of it's core functions. The wiki [0] has a decent outline of what it is (may or may not be out of date for on-prem).

[0] https://en.wikipedia.org/wiki/SharePoint

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#314

Post by kenjackson »

dijit wrote: post #269
rcbdev wrote: post #249

Earlier quoted context omitted.

But, he truly does. That is not because they have caused any offence, it's just that this pattern of behaviour may indicate similar tendencies in other parts of the tech stack. For example, if OP for some reason stops liking a maintainer of, say, RabbitMQ or PostgreSQL, they might be penetrant about switching a finished project to a different stack without any tangible reason, causing completely unnecessary headaches…

Using collaboration and productivity software as a proxy for how the company thinks about collaboration and productivity is, good, actually. He didn’t say he doesn’t like Satya or Gates or whatever, he was clear that he doesn’t like the solution. I just went back to a microsoft shop, and honestly while the company is great you can feel how the communication is stilted compared to my previous company. Those little edg…

“I totally understand why it’s primarily MSFT shops that have RTO mandates.”

That just seems factually incorrect. I’ve seen no correlation on RTO and tools used. Do you have data on this?

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#315

Post by dotancohen »

fujigawa wrote: post #135
crmd wrote: post #94

One of the first things I do after getting an inquiry from a recruiter or friend referral is lookup the MX record for the company’s email domain. It is an anonymous one-command check to see if they’re a Microsoft shop. If they are, it’s enormous personal red flag. MSFT is very popular so I’m only speaking about my own experience, but I have learned over the course of 20 years that an MSFT IT stack is highly correlate…

I'm gonna be honest, you sound like a problem employee. The companies not using Microsoft, are using Google. Which in my experience is equally or measurably worse. Just personal data points, but every avowed Microsoft hater I've ever worked with has been... difficult. Like a-drag-on-the-team-because-he-refuses-to-use-company-tools difficult. Edit: How does an aged post on this site go from +4 to -1 in the span of a f…

  > How does an aged post on this site go from +4 to -1 in the span of a few minutes?
Oh, I can answer that one. It's happened consistently to me on HN when I post about a specific topic.

First, the post looses two points at once. When I see that, I know it's going to continue losing points consistently until it settles into -2 to -4. There is some trigger that starts with a loss of two points, and then continues down.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#316

Post by GuB-42 »

OutOfHere wrote: post #226
GuB-42 wrote: post #197

Earlier quoted context omitted.

It is not a nuclear fission facility, it is "a plant that produces the vast majority of critical non-nuclear components for US nuclear weapons". The also targeted the IT side, not the operational side, which, according to the article is likely to be airgapped. Even sensitive production facilities need some internet access, people work there and like everyone else, they need food, office supplies, toilet paper, etc...…

Something tells me they also use it to order operational side materials, including nuclear gear and materials, from the IT side. To expose this on the internet screams of idiocy.

How are they supposed to contact their suppliers without email? Even for phone calls, they are probably using some kind of VoIP. For sensitive communication, they most likely encrypt and sign their messages on the airgapped side before moving it to the internet facing side and sending it using regular email.

Not having internet access at all is like not having your building connected to public roads. That makes it harder (but not impossible) for bad guys to come, but it is so much of a hassle that almost no one does that. Instead, they use gates and checkpoints.

Same idea for internet access. They have internet access, but they have security systems, from traditional firewalls and VPNs to airgaps.

Security is about letting the good guys in while keeping the bad guys out, the latter is meaningless without the former. That's why security is hard, if is was just about blocking everything, it would be easy, but nothing would be done.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#317

Post by dotancohen »

rkomorn wrote: post #302
7thpower wrote: post #301

Earlier quoted context omitted.

Slack is an unintuitive piece of junk, and yes I will die on this hill.

It is, but all the other ones I've had the misfortune of dealing with have been worse. Including IRC.

A few years ago I worked at a company that actually used Telegram and Telegram Desktop. It was great. Available on mobile and desktop, all platforms, supports all the features we needed, new users get full history.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#318

Post by rkomorn »

dotancohen wrote: post #317
rkomorn wrote: post #302

Earlier quoted context omitted.

It is, but all the other ones I've had the misfortune of dealing with have been worse. Including IRC.

A few years ago I worked at a company that actually used Telegram and Telegram Desktop. It was great. Available on mobile and desktop, all platforms, supports all the features we needed, new users get full history.

The best I've used, and I say this in all sincerity, is actually Facebook's work platform (but it's not a chat-first experience, obviously, and that's probably what made it better).

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#319

Post by honkostani »

pxc wrote: post #234
Spooky23 wrote: post #153

Earlier quoted context omitted.

Dev tools, sure. Self-selecting yourself out of the office/email toolset used by 90% of companies seems like a weird flex.

Companies that use Microsoft for one thing invariably use it for another, and then another, and then another, because they're "already paying for it". Their business model has always been like this. Microsoft Office usage is highly predictive of lots and lots of other choices.

The whole Eco-system is designed like a lobster trap. Easy to get in, hard to get out except by swimming through hot butter sauce.

Re: Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

#320

Post by eitland »

mindok wrote: post #311
croes wrote: post #287

Earlier quoted context omitted.

How about using tools that do their job great instead of one tool that can do them all but none of them good. It tells the company values price more than capability. I asked in my company why we use SharePoint and the answer was name a better alternative. So I asked an better alternative to do what? I never got an answer.

If the objective is to put files where you can’t find them again, I think you’d be hard pressed to find a better alternative.

Except any plain file server that you can connect to via ordinary protocols?
Post reply on HN