3 ms·
I’m curious to know what the processes were that led to this. One or more API engineers either never thought to implement permissions; never thought to ask when
by tyre 6y ago
I’m curious to know what the processes were that led to this. One or more API engineers either never thought to implement permissions; never thought to ask when it wasn’t in the spec; or did ask, were told not to do it, and then didn’t.
It’s pretty basic stuff.
- dijksterhuis 6y agoMy first thought was that Microsoft (or a subset of) probably determined any impact from an adversary taking advantage of these client side settings was fairly minimal (at least the messagePolicy values). Then I remembered zoombombing is a thing and can be pretty disruptive. It could also be an inherited problem from the days when teams was actually Skype for business.
- corndoge 6y agoReading the article it definitely seems poorly worded but I don't see any evidence of any security issue here. Cosmetically changing the client is a non issue.
- tyre 6y agoPermissions are not solely about security. They can also be related to compliance. Permitting users to delete messages when they shouldn't be allowed to can raise issues. I agree that the article is kind of unclear about whether it is only a cosmetic change. The title suggests not but the article is ambiguous.