Earlier quoted context omitted.
Isn't it an age thing mostly? Younger admins hate Microsoft with a passion it seems to me. Or is just my circle of acquaintances?
Well, as far as my experience, we the old generation despise Microsoft even more
Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
41–50 of 116 posts
Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
#42There's a big tradeoff here though: IT admins really love buying Microsoft. And when the dog tries to complain about the dogfood, the dogfood purchaser tends to not understand very well.
Isn't it an age thing mostly? Younger admins hate Microsoft with a passion it seems to me. Or is just my circle of acquaintances?
Try managing a directory service even on RedHat and see how it goes.
Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
#43> Having done a fair bit of logging to databases with various scripts, I believe this was a simple matter of overflowing the SQL column length for a field, causing the entire INSERT to fail. This is a common beginner mistake when you first start to work with databases. I'm not sure if I understand this part. I'm trying to put it into my own words. Is the following correct? The attacker provided an input that was so l…
Reading through the article I can't help but think that many of these authentication/authorization flows are entirely to complex. I understand that they need to be, for some use cases, but those are probably not the majority.
Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
#44Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
#45Earlier quoted context omitted.
> He mumbled something about GDPR, which is nonsense, because we're on the opposite side of the planet from Europe. It was also nonsense because the GDPR is crystal clear about where PII may be used. Audit logs are one of those exceptions where the goal of identifying users simply permits storing usernames and associated attributes (certainly in the case of upgrading a paid plan). This wasn't about the GDPR; you were…
> This wasn't about the GDPR; you were being told to sod off. Vast misunderstanding of GDPR by the clowns implementing it is also possible; or just "can't be arsed so hide it all"
Most businesses using a public cloud need to log the activities of their staff accessing their own systems, which has an entirely different set of policies.
A similar example is Azure Application Insights. Microsoft uses it internally, so they keep removing features that log PII to be "GDPR compliant". Again, they're logging the activities of the general public across the entire world population, so GDPR legitimately applies. To them! Not us. Most of our scenarios are internal staff or partner organisations accessing private systems. Not only do we not do business with anyone from Europe, our systems are either privately networked or geo region locked. Europeans can't access anything in our local state government's internal staff portal even if they wanted to! Unless they hack us... but then we would very much like to log that.
Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
#46Earlier quoted context omitted.
Isn't it an age thing mostly? Younger admins hate Microsoft with a passion it seems to me. Or is just my circle of acquaintances?
You don't get promoted to positions with power to choose for hating Microsoft.
Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
#47There's a big tradeoff here though: IT admins really love buying Microsoft. And when the dog tries to complain about the dogfood, the dogfood purchaser tends to not understand very well.
Isn't it an age thing mostly? Younger admins hate Microsoft with a passion it seems to me. Or is just my circle of acquaintances?
I... get it.
The FAANGS needed to scale to a level where paying per-core licensing fees for an operating system was simply out of the question, not to mention the lack of customisability.
As a consequence, they all adopted Linux as their core server operating system.
Then, as their devs made millions in share options, they all scattered and made thousands of little startups... each one of which cloned the assumption that only Linux was a viable operating system for servers.
The mistake here is the same one that caused "Only MongoDB is Web Scale" and "Microservices are necessary for two devs and a PC as our server".
Just because a trillion dollar corporation decides on a thing, it does not mean it applies universally.
Outside of this bizarre little bubble, Windows is everywhere and Windows Server is still about 50% of the overall server market.
Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
#48There's a big tradeoff here though: IT admins really love buying Microsoft. And when the dog tries to complain about the dogfood, the dogfood purchaser tends to not understand very well.
Isn't it an age thing mostly? Younger admins hate Microsoft with a passion it seems to me. Or is just my circle of acquaintances?
Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
#49There's a big tradeoff here though: IT admins really love buying Microsoft. And when the dog tries to complain about the dogfood, the dogfood purchaser tends to not understand very well.
Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found
#50IIRC, (& I don't remember if I reported it), but Azure's audit logs don't reflect reality when you delete a client secret from the UI, either. If I remember the issue right, we lost a client secret (it just vanished!) and I went to the audit logs to see who dun it. According to the logs, I had done it. And yet, I also knew that I had not done it. I eventually reconstructed the bug to an old page load. I had the page…