Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft Teams: 1 feature, 4 vulnerabilities

positive.security

Post reply on HN
Print view View original

61–70 of 264 posts

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#61

Post by detaro »

pydry wrote: post #36
JumpCrisscross wrote: post #23

Earlier quoted context omitted.

> a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft Zoom had and continues to have a significant developer presence in China. Those individuals are subject to CCP coercion. There was also a time when they routed American calls through the mainland [1]. That has been fixed. But it remains excessive to cast all past criticism of Zoom as Microsoft's work. [1] https://techcrunch.com/2020/04/0…

I remember when they stories came out they were released in a suspiciously coordinated way. Once one died off another was released to build up momentum again and keep the idea humming in the public consciousness. I figured that it was done by a big party that had a trusted relationship with tech journalists because they bigged up vulnerabilities that were relatively minor to journalists who didnt seem to be aware of…

The pattern of stories indicated that it was a thing that got attention, so people went digging for whatever they could find and push. You don't need a conspiracy for something to get way more attention than others.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#62

Post by [deleted] »

ygra wrote: post #49
pydry wrote: post #17

In 2020 a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft led to a company-wide prohibition on using anything other than Teams "for security reasons" where i worked. This was, I am almost certain, inspired by Microsoft corporate sales getting their hooks into management. This was largely because of news stories like "end to end encryption doesnt really work as advertised" and "if you leav…

At least in Germany the most common reason not to use Zoom has been privacy and data protection, not so much security. Haven't heard the security reason yet.

[deleted]

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#63

Post by azalemeth »

cloudengineer94 wrote: post #22
smcleod wrote: post #20

Earlier quoted context omitted.

It is (by far) the most horrific piece of software I'm forced to used, the UI/UX is confusing, it's a battery killer, eats all the ram (though - that's common with all electron garbage), it somehow manages to make Bluetooth headsets drop out, it significantly impacts network performance when sharing video, a lot of bugs in the calendaring system.... I could go on, but damn I just hate it.

When I used to have my i9 16" MBP, the thing would go crazy and hit 90% CPU usage during web calls on Teams. I had to force myself to have it in clamshell mode to avoid crazy stuff going on.

Use it in a browser. At least you can close the browser, and to be honest desktop Chrome seems to have better power management.

Of course, sometimes you then get the "Your browser is unsupported -- please use Microsoft Edge or Google Chrome" message, whilst using Chrome...

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#64

Post by josefx »

iso1631 wrote: post #3
xvector wrote: post #2

What is the solution? More security education for general SWEs? It seems like whatever team worked on this feature never considered any security perspectives.

Make all software which isn't released as open source liable for the cost of security breaches?

open source did not stop Heartbleed. How about force commercial software companies to have 1 in 10 devs. dedicated to security with even a single feature ticket getting fixed by one of them resulting in a fine of ~5% of the yearly revenue.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#65

Post by Nextgrid »

brisad wrote: post #51
smcleod wrote: post #20

Earlier quoted context omitted.

It is (by far) the most horrific piece of software I'm forced to used, the UI/UX is confusing, it's a battery killer, eats all the ram (though - that's common with all electron garbage), it somehow manages to make Bluetooth headsets drop out, it significantly impacts network performance when sharing video, a lot of bugs in the calendaring system.... I could go on, but damn I just hate it.

I agree so much! It is baffling to me that so many companies/schools/individuals are actively using it. It is _so_ _bad_. Messages are lost, it reboots spontaneously, it crashes, one cannot turn off emoticons (I think (the UI doesn't help)), etc. It does not even take security seriously. What is good about that software? And then when I talk about this with colleagues, they seem to be just fine with it... Anyway, sor…

The reason people use it is because either they don’t have a say in it or they legitimately never used anything better (such as Slack or the lesser-known competitors like Mattermost).

If your benchmark is Skype for Business or email then I guess Teams is indeed an upgrade, and Microsoft is betting on that.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#66

Post by simion314 »

ssdspoimdsjvv wrote: post #30
emerongi wrote: post #12

Earlier quoted context omitted.

Somehow we still have medicine (they do a lot of testing before they release anything!) and doctors (they have insurance!). It would increase the barrier to releasing software massively (possibly killing the startup scene altogether), but it doesn't mean software development would end.

If we applied the same rigorous testing and verification processes in medicine to software, software development as we know it would definitely end. It would probably take years to convert a straight-forward requirement into a working piece of software. Something like Teams or VS Code that get new features added all the time would not be possible anymore and would cost tons of money. And while security issues should…

>Something like Teams or VS Code that get new features added all the time would not be possible anymore and would cost tons of money. And while security issues should not be taken lightly, I don't consider leaking my user agent to be as big of a problem as getting permanent damage from low-quality medical care.

It won't take years. We will have to train developers and create better tools. Then you will libraries and apps sandboxed, like we would not allow an IDE full access to the internet, or to the entire hard drive without permissions.

Say you get the task to build an RSS reader, you will have to choose:

1 use a language+standard library that is safe and the vendor offers some warranty

2 use an unsafe language or some unsafe libraries but you will have to take the risks and do the work to review and evaluate

3 in case you prefer open source you find a language and ecosystem where there is some foundation that even if it can't offer some warranty it accepts donations and contributions that are directly targeted on security, so you would have packages that would have a checkmark that was reviewed by a team.

So I would use a safe language(a GC one) with a trusted standard library, so now I can do the network requests to grab the XML files , parse them with the secure XML library and render the content in the safe Web View provided.

This means that the guys that give or sell me the XML library and the Web View will take the risk, but they can charge for their work. We would probably get smart developers using some extremely safe languages like math safe not Rust(safer then C safe) and this guys can write a maybe slower but 100% web view (maybe with less shiny animations).

Capitalism would be forced to invest in this safer tools and in training the developers, Microsoft ,Apple, Google will have to secure their unsafe OS and libraries but for sure it would not take 1 guy years to build an RSS reader that would not take over your data and send it to some hacker somewhere.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#67

Post by iso1631 »

pid-1 wrote: post #25
xvector wrote: post #2

What is the solution? More security education for general SWEs? It seems like whatever team worked on this feature never considered any security perspectives.

I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need). I have no security education, but I care about stuff because I will be held responsible if we get pwned at some point. IMO the biggest issue is that SWEs very rarely have long term skin in the game in the projects they are committing to. Many have strong incentive…

> I work as a sysadmin and everyday is an uphill battle to convince people to not do dumb shit like exposing endpoints to the public internet (without need).

I find it helpful to have standard low cost (certainly no monetary cost, but also little in the way of bureaucratical cost) solutions which remove the need.

E.G.

"I need to access this device's webpage from everywhere"

"Fine, go via this proxy which has oidc integration with our corporate identity, Here's the URL, let me know if there's any problems"

Doesn't always work, but it certainly reduces the fights.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#68

Post by Nextgrid »

vladvasiliu wrote: post #50
m_mueller wrote: post #14

I have a hard time understanding why MS is investing so much into VS Code yet so little progress is made on MS Teams (which in theory should be more important to them as it has broader usage?).

With VSCode, they had to prove themselves in order to bring people in. No one would have used it if it were as horrible as Teams. With Teams, on the other hand, they've got nothing to "prove", they just need to show up. Enterprises eat it up automatically because they already use Office, so "it's free". I also don't think they have any hope of attracting people from outside the MS ecosystem, so they don't even try. I…

Exactly. Developers aren’t stupid and most have experience with legitimately good tools - you’re not going to win them over with a pile of shit like Teams.

The target market for Teams however is one that’s often non-technical and has never used anything better, so for them Teams is an upgrade.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#69

Post by Philip-J-Fry »

IiydAbITMvJkqKf wrote: post #34

MS Teams is the worst software I've ever used. This is not hyperbole. A room full of monkeys on a typewriter would never create something as bad as teams.

One day they just completely fucked the ability to paste code. It worked flawlessly before and then suddenly it removes indenting, bugs out and doesn't let you exit the preformatted code block. It's so bugged, it's like they didn't even test it. They couldn't have, one day it literally worked fine and the next it was unusable and could be replicated every single time.

And why there isn't the ability to just delete the rich text formatting and write markdown I do not know. They can't build a bug free rich text editor or one with intuitive controls. It's the same problem I have with Jira, the rich text editor just does not work like it should.

Re: Microsoft Teams: 1 feature, 4 vulnerabilities

#70

Post by deng »

vladvasiliu wrote: post #44
cloudengineer94 wrote: post #18

Earlier quoted context omitted.

I know right? Plus MS Teams is the among the most used apps in the enterprise world how come the only good version of it is only available in Windows 11 where most workplaces aren't even pushing it to their users. The way Microsoft handles Teams annoys the crap out of me the MacOS and Linux versions are left to die basically.

> the MacOS and Linux versions are left to die basically. I hate Teams as much as the next guy, but I'm not sure what you mean by this. On Linux, I have version 1.4.00.26453, vs 1.4.00.32771 on Windows 11 (installed fresh today). Also, the Windows experience is just as atrocious as on Linux, so for once I don't get the feeling that Linux is a second-class citizen. If anything, all citizens are last-class.

The version numbers are lying. The Linux version is missing important features, like seeing more than 4 participants at the same time, or blurring the background. Also, for some reason it is often not possible to see the camera picture of participants when they start screen sharing (if they are using the Linux version, that is).
Post reply on HN