5 ms·

Anyone who thinks "Embrace Extend, Extinguish", amongst other bad business practices, are a thing of the past for Nadella-helmed Microsoft, this should be a tal

Anyone who thinks "Embrace Extend, Extinguish", amongst other bad business practices, are a thing of the past for Nadella-helmed Microsoft, this should be a tall frosty glass of reality.

adrenalinelol 10y ago
While it's not directly related, I'd argue the antiques of the dark pattern Windows 10 upgrades show a glimpse of a company culture that is yearning to have enough monopoly power again to become anti-consumer as they were in their heyday (90s, early 2000s). If Nandella didn't view that is being wrong, then this shouldn't be a surprise either imo.
- userbinator 10y ago
  to have enough monopoly power again to become anti-consumer as they were in their heyday (90s, early 2000s). I'd say they weren't as anti-consumer back then as they are now. In particular, backwards compatibility was highly valued and I don't remember much in the way of forced "upgrades" or aggressive feature-removals/UI changes in the late 90s/early 2000s.
  - gurkendoktor 10y ago
    The way I see it, Microsoft had respect for consumers back then, but zero for its competition. Now it's the other way around - Microsoft will actually build nice apps for iOS and let you build a platform on Azure and all that, but if you use their stuff, then you better OBEY OBEY OBEY.
yodon 10y ago
WinRT is a discontinued platform for which maybe 6 people in the world purchased devices. There may well be a tall frosty glass of reality to be drunk, but it's hiding behind the list of issues that are way too small for Nadella or anyone else in senior leadership at a company the size of Microsoft to get involved in.
- petecox 10y ago
  They provided a build of Windows 10 for old Lumias, so it would be a gesture of goodwill to crank out "Windows 10 Mobile for Tablets" for those 'maybe 6 people'. After all, what is a Surface RT except a large screen phone that doesn't make phone calls.
- anonbanker 10y ago
  perhaps it should be "Embrace, Extend, Extingish, and Minimize". after all, it was only an old platform that only sold a few million units.
ZenoArrow 10y ago
This patch does seem unnecessary, I grant you that much, but I don't think it's an example of EEE. Surface RT tablets were sold as locked down devices from the start, just like many other tablets on the market today. You can't really apply EEE if the 'Embrace' part is missing.
- voltagex_ 10y ago
  From the article / advisory: > An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded on a target device. In addition, an attacker could bypass the Secure Boot Integrity Validation for BitLocker and the Device Encryption security features. So if Microsoft didn't patch this, you could equally accuse them of leaving bad security flaws in Windows 8.1. Damned if they do...
  - geofft 10y ago
    Wow. Yes, that changes this completely. Being able to let unsigned code boot on your device is very different from being able to let code you have signed boot, which is what we need for users to have effective control over their computing.
    - pritambaral 10y ago
      But it was Microsoft who mandated that Surface RT devices should not have any user configurable options when it comes to SecureBoot.
      - Aloha 10y ago
        Yes. Users also had the choice to buy something different - like any of the other ARM tablets with broadly similar hardware specs that already run linux.
        anonbanker 10y ago
        victim-blaming is in bad taste, don't you think? Especially within a hacker culture that has seen their right to hack their hardware as self-evident.
kristianp 10y ago
What catch-phrase applies to Microsoft's creation of Linux Subsystem for Windows? "Embrace, Emulate, Extend, Extinguish"!?
- m_mueller 10y ago
  I'm sure if they got enough linuxers on their azure platform they'd love to tighten the rope again. This is all still in the embrace phase, but it's likely to stay there - MS has nothing to loose but also not that much opportunity to win. Amazon and Google are just too far ahead IMO.
unscaled 10y ago
Well, not patching a security flaw is not exactly a good business practice either. Now, locking the Windows RT bootloader was a bad practice to begin with, and it's a good thing Microsoft stopped doing that. Then again, it's hard to blame them, seeing that Apple keeps locking down everything they can lay their hands on with virtually no criticism outside the Slashdot crowd perhaps. Everyone just keeps nodding and saying "This is the right thing for protecting their users and ecosystem. Look at all the fragmentation and malware mess that Android suffers from". And what is with that "Embrace, Extend and Extinguish"? It's 2016. Next thing, IBM will come selling their Watson SaaS and everyone would have to buy it because "nobody ever got fired for buying IBM "?
- yAnonymous 10y ago
  The attacker needs root or physical access, so at that point it hardly qualifies as a security flaw anymore.
  - Dayshine 10y ago
    Except it's a vulnerability for bitlocker, which is exactly for defending against physical access?
- anonbanker 10y ago
  "it's CURRENT YEAR" is hardly refutation of the fact that it's still happening. Especially when you follow it up with a strawman about IBM. now, let me channel dang for a second here: HN looks down on these types of posts filled with logical fallacy (ad hominem, appeal to ridicule, moving goalposts). You would have made your point with the first two sentences alone.
vomitcuddle 10y ago
Microsoft is still the king of the (enterprise) desktop. They've been more open on the server front, because they realised that they can't win that war.

Anyone who thinks "Embrace Extend, Extinguish", amongst other bad business practices, are a thing of the past for Nadella-helmed Microsoft, this should be a tall frosty glass of reality.

adrenalinelol 10y ago

While it's not directly related, I'd argue the antiques of the dark pattern Windows 10 upgrades show a glimpse of a company culture that is yearning to have enough monopoly power again to become anti-consumer as they were in their heyday (90s, early 2000s). If Nandella didn't view that is being wrong, then this shouldn't be a surprise either imo.

userbinator 10y ago
to have enough monopoly power again to become anti-consumer as they were in their heyday (90s, early 2000s). I'd say they weren't as anti-consumer back then as they are now. In particular, backwards compatibility was highly valued and I don't remember much in the way of forced "upgrades" or aggressive feature-removals/UI changes in the late 90s/early 2000s.
- gurkendoktor 10y ago
  The way I see it, Microsoft had respect for consumers back then, but zero for its competition. Now it's the other way around - Microsoft will actually build nice apps for iOS and let you build a platform on Azure and all that, but if you use their stuff, then you better OBEY OBEY OBEY.

yodon 10y ago

WinRT is a discontinued platform for which maybe 6 people in the world purchased devices. There may well be a tall frosty glass of reality to be drunk, but it's hiding behind the list of issues that are way too small for Nadella or anyone else in senior leadership at a company the size of Microsoft to get involved in.

petecox 10y ago
They provided a build of Windows 10 for old Lumias, so it would be a gesture of goodwill to crank out "Windows 10 Mobile for Tablets" for those 'maybe 6 people'. After all, what is a Surface RT except a large screen phone that doesn't make phone calls.
anonbanker 10y ago
perhaps it should be "Embrace, Extend, Extingish, and Minimize". after all, it was only an old platform that only sold a few million units.

ZenoArrow 10y ago

This patch does seem unnecessary, I grant you that much, but I don't think it's an example of EEE. Surface RT tablets were sold as locked down devices from the start, just like many other tablets on the market today. You can't really apply EEE if the 'Embrace' part is missing.

voltagex_ 10y ago
From the article / advisory: > An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded on a target device. In addition, an attacker could bypass the Secure Boot Integrity Validation for BitLocker and the Device Encryption security features. So if Microsoft didn't patch this, you could equally accuse them of leaving bad security flaws in Windows 8.1. Damned if they do...
- geofft 10y ago
  Wow. Yes, that changes this completely. Being able to let unsigned code boot on your device is very different from being able to let code you have signed boot, which is what we need for users to have effective control over their computing.
  - pritambaral 10y ago
    But it was Microsoft who mandated that Surface RT devices should not have any user configurable options when it comes to SecureBoot.
    - Aloha 10y ago
      Yes. Users also had the choice to buy something different - like any of the other ARM tablets with broadly similar hardware specs that already run linux.
      - anonbanker 10y ago
        victim-blaming is in bad taste, don't you think? Especially within a hacker culture that has seen their right to hack their hardware as self-evident.

kristianp 10y ago

What catch-phrase applies to Microsoft's creation of Linux Subsystem for Windows? "Embrace, Emulate, Extend, Extinguish"!?

m_mueller 10y ago
I'm sure if they got enough linuxers on their azure platform they'd love to tighten the rope again. This is all still in the embrace phase, but it's likely to stay there - MS has nothing to loose but also not that much opportunity to win. Amazon and Google are just too far ahead IMO.

unscaled 10y ago

Well, not patching a security flaw is not exactly a good business practice either. Now, locking the Windows RT bootloader was a bad practice to begin with, and it's a good thing Microsoft stopped doing that. Then again, it's hard to blame them, seeing that Apple keeps locking down everything they can lay their hands on with virtually no criticism outside the Slashdot crowd perhaps. Everyone just keeps nodding and saying "This is the right thing for protecting their users and ecosystem. Look at all the fragmentation and malware mess that Android suffers from". And what is with that "Embrace, Extend and Extinguish"? It's 2016. Next thing, IBM will come selling their Watson SaaS and everyone would have to buy it because "nobody ever got fired for buying IBM "?

yAnonymous 10y ago
The attacker needs root or physical access, so at that point it hardly qualifies as a security flaw anymore.
- Dayshine 10y ago
  Except it's a vulnerability for bitlocker, which is exactly for defending against physical access?
anonbanker 10y ago
"it's CURRENT YEAR" is hardly refutation of the fact that it's still happening. Especially when you follow it up with a strawman about IBM. now, let me channel dang for a second here: HN looks down on these types of posts filled with logical fallacy (ad hominem, appeal to ridicule, moving goalposts). You would have made your point with the first two sentences alone.

vomitcuddle 10y ago

Microsoft is still the king of the (enterprise) desktop. They've been more open on the server front, because they realised that they can't win that war.