3 ms·

That’s a stretch. If we fired everyone every time something like this happened, you would have nobody working in tech. This bug does not result in data leakage/

by koluna 6y ago

That’s a stretch. If we fired everyone every time something like this happened, you would have nobody working in tech. This bug does not result in data leakage/disclosure, nor it put anyone’s business at significant risk. Lesson learned, let them fix it, and see what we can learn.

remote_phone 6y ago
This is an enterprise product. Enterprise customers are expecting at least decent security. How long has this been out? My son’s therapist uses Teams because she said it had better security. This is 2020. Microsoft is 40 years old. How many times should we repeats the same dumb mistakes over and over again until we collectively learn as an industry. This should have been stopped at the initial design phase. Clearly those in charge can’t make simple design decisions or haven’t learned from decades of mistakes. Also migrating from client side to server side means an entirely new version of APIs. It means clients being broken and migration issues for customers. New servers with old clients means backwards compatibility, etc. It will take years unless Microsoft kills the old version aggressively which they won’t because they’re Microsoft. This is a problem that will live on for 5 years at least.
- koluna 6y ago
  How is this a security risk for your therapist?
- wizzwizz4 6y ago
  This isn't a security issue. Teams policies are basically “please don't talk in the $FOO channel, it's for $FOO messages only”; the actual access is done through Sharepoint. (Though make sure you're not using Channels for security; it's trivial to get into all the Channels in a Team once you have access to the Team.) Also? Teams is a glorified website running in a (hopefully up-to-date) embedded version of Chrome. If they replace some of the scripts it requests with “redirect to this updated Teams client”, then by golly it'll do that, and server-side API changes won't matter in the slightest.

by koluna 6y ago

remote_phone 6y ago

This is an enterprise product. Enterprise customers are expecting at least decent security. How long has this been out? My son’s therapist uses Teams because she said it had better security. This is 2020. Microsoft is 40 years old. How many times should we repeats the same dumb mistakes over and over again until we collectively learn as an industry. This should have been stopped at the initial design phase. Clearly those in charge can’t make simple design decisions or haven’t learned from decades of mistakes. Also migrating from client side to server side means an entirely new version of APIs. It means clients being broken and migration issues for customers. New servers with old clients means backwards compatibility, etc. It will take years unless Microsoft kills the old version aggressively which they won’t because they’re Microsoft. This is a problem that will live on for 5 years at least.

koluna 6y ago
How is this a security risk for your therapist?
wizzwizz4 6y ago
This isn't a security issue. Teams policies are basically “please don't talk in the $FOO channel, it's for $FOO messages only”; the actual access is done through Sharepoint. (Though make sure you're not using Channels for security; it's trivial to get into all the Channels in a Team once you have access to the Team.) Also? Teams is a glorified website running in a (hopefully up-to-date) embedded version of Chrome. If they replace some of the scripts it requests with “redirect to this updated Teams client”, then by golly it'll do that, and server-side API changes won't matter in the slightest.