6 ms·

the problem is DNS, as one would guess: >the default or example Active Directory path was given as “corp,” and many companies apparently adopted this setting w

the problem is DNS, as one would guess: >the default or example Active Directory path was given as “corp,” and many companies apparently adopted this setting without modifying it to include a domain they controlled. whew boy. whats the right answer here? out of the box AD and DNS coming with default settings that must be changed prior to use?

astrea 7y ago
I feel as though we hear about some horrible security flaw from Microsoft every other day.
- wwn_se 7y ago
  They are very transparent about security. Very few companies are on their level of security maturity maybe a handful.
- nkozyra 7y ago
  Is this really a security flaw from Microsoft, necessarily, or just a convention adopted that leads to a lot of accidental misdirection of traffic? Don't get me wrong, making users be explicit is ideal, but this doesn't feel like it belongs in the same boat.
  - MichaelApproved 7y ago
    It's definitely a security flaw created by Microsoft. A default/pre-filled value should be an acceptable value to use. By prepopulating "Corp", they implied that it was an acceptable value their customers could use. What else would you think a prepopulated value would mean? Fixing a flaw this big for what we assume is under $2 million seems like a bargain.
    - jaclaz 7y ago
      I don't know. Meaning that in this case the MS customers are not "end customers", they are highly specialized (in theory) and highly paid (in practice) IT specialists setting up (part of) a complex (and security sensible) corporate network backbone such as Active Directory.
      - jedieaston 7y ago
        Except that this was also the default in SBS, a product specifically designed for a small business with little to no IT staff. (Why a small business that didn't have IT staff would bother with AD I do not know, but I believe the package also included an email server?)
        jaclaz 7y ago
        Yep, but come on, any small business owner won't even know what AD is or why it should be used, and they would be convinced to use it by an external consultant (as well in theory belonging to the highly spoecialised and highly paid IT people). This leaves us with only a part of small businesses (the ones where the owner let his daughter's son, or his cousin, which is "good at computers" manage their network).
    - holtalanm 7y ago
      but they didn't pre-populate it. they used 'corp' within their instruction text as a placeholder for whatever the corporation wanted to use. from my understanding, nothing was pre-populated.
      - kps 7y ago
        I'll give them a break if the text predates RFC2606 (1999) and the product hasn't been touched since. > Confusion and conflict can be caused by the use of a current or future top level domain name in experimentation or testing, as an example in documentation, to indicate invalid names, or as a synonym for the loop back address. Test and experimental software can escape and end up being run against the global operational DNS. Even examples used "only" in documentation can end up being coded and released or cause conflicts due to later real use and the possible acquisition of intellectual property rights in such "example" names. (emphasis added)
jabroni_salad 7y ago
Currently when putting in a new AD the name field is just blank and you have to put something in to continue. There is no default setting.
W4ldi 7y ago
most linux server distributions come without a firewall installed/activated. does this default mean it's linux' fault when users do not setup a firewall?
- ed312 7y ago
  At least a little? That's extremely hostile behavior to new users. I could see not shipping a lot of these things for a highly optimized server version etc. For a standard end user (and let's be honest, middle/large company IT dept guy), you should put some sane defaults in place.
  - crankylinuxuser 7y ago
    Another part about the firewall is that without profiling, it's pretty hard to make a good firewall that allows "good traffic" and denies the "bad". It takes a good amount of profiling and being a firewall admin. And for a house, thats kind of overkill for the general network. Sure, set up a restricted wifi for IoT crap, but having to fiddle with it daily is NOT acceptable.
- cesarb 7y ago
  Well, it's hard for a Linux server distribution to not come with a firewall installed, since it's part of the kernel; all Linux distributions I've seen (including tiny floppy-disk-based Linux distributions) come with the firewall module enabled in the kernel configuration. As for being activated: my recent experience with is mostly with RedHat-derived Linux server distributions (like CentOS), and they do come with the firewall enabled (which more than once made things not work until we noticed it was the firewall again). That didn't use to be the case in the distant past, however.
- mercora 7y ago
  thats is one of the reasons i think its not smart to automatically start some services per default after package install on Debian. I guess its justified by having sane default service configurations but its still a bad idea in my opinion.
pantalaimon 7y ago
There might be a reason why example.org was chosen for documentation purpose.
- tialaramex 7y ago
  The example TLD is also reserved, for when your example needs a TLD rather than a 2LD or some other domain. This allows you to make up a bunch of 2LDs in documentation e.g. https://cat-food.example/ https://cat-food.example/ https://dog-food.example/ https://dog-food.example/ and https://pet-food.example/ https://pet-food.example/ might be three different companies that sell pet foods, or they might all be brands of the same company, whereas if I used names like https://cat-food.example.org/ https://cat-food.example.org/ and https://dog-food.example.org/ https://dog-food.example.org/ that's confusing because we'd say it's very unlikely for rival companies to share a 2LD this way.
andrewaylett 7y ago
It's perfectly possible that many of the AD domains affected pre-date ubiquitous laptops, and desktops don't tend to roam so are unlikely to meet a differently-configured search domain.

astrea 7y ago

I feel as though we hear about some horrible security flaw from Microsoft every other day.

wwn_se 7y ago
They are very transparent about security. Very few companies are on their level of security maturity maybe a handful.
nkozyra 7y ago
Is this really a security flaw from Microsoft, necessarily, or just a convention adopted that leads to a lot of accidental misdirection of traffic? Don't get me wrong, making users be explicit is ideal, but this doesn't feel like it belongs in the same boat.
- MichaelApproved 7y ago
  It's definitely a security flaw created by Microsoft. A default/pre-filled value should be an acceptable value to use. By prepopulating "Corp", they implied that it was an acceptable value their customers could use. What else would you think a prepopulated value would mean? Fixing a flaw this big for what we assume is under $2 million seems like a bargain.
  - jaclaz 7y ago
    I don't know. Meaning that in this case the MS customers are not "end customers", they are highly specialized (in theory) and highly paid (in practice) IT specialists setting up (part of) a complex (and security sensible) corporate network backbone such as Active Directory.
    - jedieaston 7y ago
      Except that this was also the default in SBS, a product specifically designed for a small business with little to no IT staff. (Why a small business that didn't have IT staff would bother with AD I do not know, but I believe the package also included an email server?)
      - jaclaz 7y ago
        Yep, but come on, any small business owner won't even know what AD is or why it should be used, and they would be convinced to use it by an external consultant (as well in theory belonging to the highly spoecialised and highly paid IT people). This leaves us with only a part of small businesses (the ones where the owner let his daughter's son, or his cousin, which is "good at computers" manage their network).
  - holtalanm 7y ago
    but they didn't pre-populate it. they used 'corp' within their instruction text as a placeholder for whatever the corporation wanted to use. from my understanding, nothing was pre-populated.
    - kps 7y ago
      I'll give them a break if the text predates RFC2606 (1999) and the product hasn't been touched since. > Confusion and conflict can be caused by the use of a current or future top level domain name in experimentation or testing, as an example in documentation, to indicate invalid names, or as a synonym for the loop back address. Test and experimental software can escape and end up being run against the global operational DNS. Even examples used "only" in documentation can end up being coded and released or cause conflicts due to later real use and the possible acquisition of intellectual property rights in such "example" names. (emphasis added)

jabroni_salad 7y ago

Currently when putting in a new AD the name field is just blank and you have to put something in to continue. There is no default setting.

W4ldi 7y ago

most linux server distributions come without a firewall installed/activated. does this default mean it's linux' fault when users do not setup a firewall?

ed312 7y ago
At least a little? That's extremely hostile behavior to new users. I could see not shipping a lot of these things for a highly optimized server version etc. For a standard end user (and let's be honest, middle/large company IT dept guy), you should put some sane defaults in place.
- crankylinuxuser 7y ago
  Another part about the firewall is that without profiling, it's pretty hard to make a good firewall that allows "good traffic" and denies the "bad". It takes a good amount of profiling and being a firewall admin. And for a house, thats kind of overkill for the general network. Sure, set up a restricted wifi for IoT crap, but having to fiddle with it daily is NOT acceptable.
cesarb 7y ago
Well, it's hard for a Linux server distribution to not come with a firewall installed, since it's part of the kernel; all Linux distributions I've seen (including tiny floppy-disk-based Linux distributions) come with the firewall module enabled in the kernel configuration. As for being activated: my recent experience with is mostly with RedHat-derived Linux server distributions (like CentOS), and they do come with the firewall enabled (which more than once made things not work until we noticed it was the firewall again). That didn't use to be the case in the distant past, however.
mercora 7y ago
thats is one of the reasons i think its not smart to automatically start some services per default after package install on Debian. I guess its justified by having sane default service configurations but its still a bad idea in my opinion.

pantalaimon 7y ago

There might be a reason why example.org was chosen for documentation purpose.

tialaramex 7y ago
The example TLD is also reserved, for when your example needs a TLD rather than a 2LD or some other domain. This allows you to make up a bunch of 2LDs in documentation e.g. https://cat-food.example/ https://cat-food.example/ https://dog-food.example/ https://dog-food.example/ and https://pet-food.example/ https://pet-food.example/ might be three different companies that sell pet foods, or they might all be brands of the same company, whereas if I used names like https://cat-food.example.org/ https://cat-food.example.org/ and https://dog-food.example.org/ https://dog-food.example.org/ that's confusing because we'd say it's very unlikely for rival companies to share a 2LD this way.

andrewaylett 7y ago

It's perfectly possible that many of the AD domains affected pre-date ubiquitous laptops, and desktops don't tend to roam so are unlikely to meet a differently-configured search domain.