Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found

trustedsec.com

Post reply on HN
Print view View original

61–70 of 116 posts

Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found

#61

Post by giancarlostoro »

Imagine if Microsoft spend more attention on making Windows suck less and Azure better, because in my eyes it is not as awful as whatever the heck AWS' dashboard is supposed to be. Azure has a rich set of developer libraries for their offerings, and their dashboard isn't nearly as awful as AWS. I've never used GCP so I can't comment on theirs, or their libraries.

It should really horrify everybody that Microsoft is not investing more into Azure considering they host the worlds most known LLM (and used?).

Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found

#63

Post by evanjrowley »

philipallstar wrote: post #55
isodev wrote: post #19

Earlier quoted context omitted.

Ah yes, back when the US actually had cyber defence and experts capable of working in their respective fields.

They're the ones that had the Microsoft tech procured and implemented.

This, exactly. There are so many "cyber experts" working for the U.S. government, and the vast majority are just cogs in a machine constructed by executive leadership who will always prefer inertia over radical changes.

Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found

#64

Post by toomuchtodo »

twoodfin wrote: post #58
benterix wrote: post #36

Earlier quoted context omitted.

It's true, they lied. But, paradoxically, in this case, while they lied about details, the conclusion is still true: Azure is very far from AWS and GCP as far as security is concerned. I have my own suspicions why it is so, but the reasons are not important, what counts is the final conclusion: if you really care for security, you'd better chose one of the other two.

“Fake but accurate.” ProPublica has an agenda, and they slant their reporting to push it. You can like their agenda and support this effort, but it’s not journalism.

What is their agenda?

Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found

#65

Post by xp84 »

int0x29 wrote: post #10
kjellsbells wrote: post #5

Puts me in mind of this scathing report from CISA on how a state-sponsored group broke into Microsoft and then into the State Department and a bunch of other agencies. Reads like a heist movie. https://www.cisa.gov/sites/default/files/2024-03/CSRB%20Revi... What I found most incredible about the story is that it wasn't Microsoft who found the intrusion. It was some sysadmin at State who saw that some mail logs did no…

Don't worry CISA and any other involved regulator were gutted by DOGE.

Is that true or you’re just assuming it’s so?

Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found

#66

Post by lallysingh »

giancarlostoro wrote: post #61

Imagine if Microsoft spend more attention on making Windows suck less and Azure better, because in my eyes it is not as awful as whatever the heck AWS' dashboard is supposed to be. Azure has a rich set of developer libraries for their offerings, and their dashboard isn't nearly as awful as AWS. I've never used GCP so I can't comment on theirs, or their libraries. It should really horrify everybody that Microsoft is n…

I don't know why you'd believe they've ever been capable of putting out quality software.

A bug in the software is a bug in the process, and the process is the job of leadership. They've never cared about software quality. They'll put out lots of books about it, lots of talks, lots of claims. But they won't actually put out quality software. It's not in their DNA, never was.

It's not their size nor their age that makes this hard for them. Plenty of larger, older companies put out better product ever day. It's just them. Someone in each size class is the best, and someone else is the worst. MS has been the worst the entire time.

Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found

#67

Post by DetroitThrow »

jacquesm wrote: post #38
DetroitThrow wrote: post #12

Earlier quoted context omitted.

Every security engineer I know working at Azure is on the verge of self-harm because of the current situation, or is the dumbest IC I've ever met and somebody I think should have never become a security engineer. Sample size ~12.

That is quite the indictment.

I am not very close with every one of these engineers, and some no longer work at MSFT, but yes talking to employees in Seattle working on security made me never want to use Azure.

Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found

#68

Post by philipallstar »

evanjrowley wrote: post #63
philipallstar wrote: post #55

Earlier quoted context omitted.

They're the ones that had the Microsoft tech procured and implemented.

This, exactly. There are so many "cyber experts" working for the U.S. government, and the vast majority are just cogs in a machine constructed by executive leadership who will always prefer inertia over radical changes.

I don't think this is that much to do with executive leadership. Many of those cyber experts only have a job because of Microsoft based tooling and vulnerabilities, and so they will prefer things they know over things they don't know (e.g. implementing permissions across a Linux estate).

Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found

#69

Post by quinnjh »

xp84 wrote: post #65
int0x29 wrote: post #10

Earlier quoted context omitted.

Don't worry CISA and any other involved regulator were gutted by DOGE.

Is that true or you’re just assuming it’s so?

https://www.csoonline.com/article/3844047/cisa-cybersecurity...

Re: Full Disclosure: A Third (and Fourth) Azure Sign-In Log Bypass Found

#70

Post by selkin »

xp84 wrote: post #65
int0x29 wrote: post #10

Earlier quoted context omitted.

Don't worry CISA and any other involved regulator were gutted by DOGE.

Is that true or you’re just assuming it’s so?

It’s true, and briefly made the news at the time[1]. The CSRB was also decimiated, and the current DHS deputy secretary, in his confirmation hearing, called for wrecking the agency, as he disagrees with their efforts to maintain election security.

---

[1] https://techcrunch.com/2025/03/11/doge-axes-cisa-red-team-st...

Post reply on HN