5 ms·
What lessons can we learn from banging our heads on the wall? (No, "don't bang your head on the wall" doesn't count.)
by stagger87 6y ago
What lessons can we learn from banging our heads on the wall? (No, "don't bang your head on the wall" doesn't count.)
- jacquesm 6y agoAvoid Microsoft for stuff that is important, and don't install their software on your machines if you can help it.
- pjmlp 6y agoStarting by anything running on top of Electron.
- ROARosen 6y agoEspecially if said machines are actually built by Microsoft.
- boogies 6y agoIn which case they may be nice enough to block some of their software for you https://www.techrepublic.com/article/microsoft-blocks-major-windows-10-update-for-1700-flagship-surface-book-2-after-bug-makes-gpu-vanish/ https://www.techrepublic.com/article/microsoft-blocks-major-...
- coldtea 6y agoYeah, because other companies or FOSS have a better track record. E.g. we can drop Exchange for email for a safe alternative like Sendmail.
- jacquesm 6y agoYes, Google has a better track record. You brought open source and - totally unrelated - sendmail into it.
- coldtea 6y ago>Yes, Google has a better track record. Do they? This is just from last month: https://www.zdnet.com/article/google-patches-second-chrome-zero-day-in-two-weeks/ https://www.zdnet.com/article/google-patches-second-chrome-z... >You brought open source and - totally unrelated - sendmail into it. No, you brought the totally unrelated "Avoid Microsoft for stuff that is important, and don't install their software on your machines if you can help it." as if Microsoft is the only place to ever had a RCE...
- jacquesm 6y agoThat's Chrome, not meet. As for bringing in unrelated stuff, no that was still within the context of Microsoft's meeting software. It was someone else that brought in the OS.
- roel_v 6y agoOr wuftpd. I once accidentally dropped my keyboard, and it turned out that the keypresses that generated were a remote root exploit for wuftpd.
- jacquesm 6y agoWhat are the chances of that happening, that's pretty neat!
- 35fbe7d3d5b9 6y agoWith wuftpd? P(x)=1
- roel_v 6y agoEh, at first I thought so too, but then it turned out my neighbours nan once accidentally hacked the US Navy that way, so after that I didn't feel all that special any more :(
- jacquesm 6y agoHehe, that's hilarious.
- boogies 6y agoMaybe I’m in a filter bubble, but I’ve never heard of anyone else assigning such low priority to exploits like this.
- dylan604 6y agoReminds me of the old joke: VirusScanner: We found a virus on your machine called Windows. You you like to remove it?
- rakoo 6y agoBang our heads on the wall at the appropriate angle. It's only our fault if we get hurt, we must learn to properly use the tools we have
- darepublic 6y agoI bang my head against a wall everyday for a living.
- jyriand 6y agoDon't use Teams app, but connect through browser instead... that is if there is no other way to avoid Teams, because you're company has already migrated from Slack.
- toxik 6y agoCorrect me if I’m wrong but the XSS stuff still works then. Having all your Office 365 data stolen may be a problem.
- coldtea 6y agoYeah, because remote code exploits are particularly an issue with Electron, as opposed an order of magnitude less likely to happen with it compared to native code. Basically you got it completely backwards. The typical native app (which is not Rust or Java but C/C++/Obj-C, etc) only keeps the unsafe part of Electron, and even drops the sandbox (whose holes can always be patched, but total absense cannot).
- toxik 6y agoComplexity leads to RCEs like the one in TFA, not “unsafe” languages. It is very disingenuous to say that other native apps keep the unsafe parts; there are no such parts at all. It should be telling that Microsoft, in one of their most successful products of late, have punched an RCE sized hole in that sandbox unwittingly.