5 ms·

> On top of that, several vendors were exploited VMware and Microsoft. I haven't really kept up on the latest news about this hack so perhaps I missed an "offi

> On top of that, several vendors were exploited VMware and Microsoft. I haven't really kept up on the latest news about this hack so perhaps I missed an "official announcement" but I had assumed that both Microsoft and VMware were likely additional "attack vectors" as well (after initially "getting in" via Orion). Microsoft had that NETLOGON issue (CVSS 10.0) a while back and VMware has had at least two (CVSS ~9.8+) "critical" (a.k.a. "drop everything and patch now") issues that I know of in the last several months as well. Any one of those issues would almost certainly have given an attacker "the keys to the kingdom" (and, from my own experience at least, domain controllers, ESXi hypervisors, and vCenter servers don't typically get updated immediately!). > I’ve fought for the federal government to create instead of buy. Unfortunately, that just leads to the Government paying way too much for designed by committee software that isn't compatible with anything that anyone else uses. We've been there before and, IMO, the shift to COTS software was one of the best things to ever happen to U.S. Government agencies. (On a side note, I've lost a lot of faith in VMware. For something they claim to be "secure by default", there sure have been a shitload of CVEs in the last year or two! Also, just a few months ago, they had to "re-release" patches for a 9.8 because the original patches didn't completely fix the issue!)

SSLy 6y ago
VMware is preoccupied with stealing Linux code, not fixing bugs.
- jlgaddis 6y ago
  Yep, it seems like 90% or more of "their" products are simply open-source code with a web-based front-end that they've slapped on (which is why I refuse to give them any money).
dannyw 6y ago
The federal government should not create its own operating system, or log system, but it should pour all of its resources into properly securing the systems it uses; weighted by its security risk. Systems running in root or hypervisor space deserve the most scrutiny and sandboxing. A JS app, less so, assuming its run in a secure sandboxed browser in a secure sandboxed operating system. Attack vectors like Intel ME must die. (There are already DoD- mandated high-assurance flags to disable parts of ME; but megabyte blobs running on ring -1 must go completely so we can secure ring 0).
- brobdingnagians 6y ago
  Isn't that what the NSA is supposed to do? They failed. They seem to have a big enough budget. I don't think they are incompetent. If they stopped stockpiling vulnerabilities and instead actually tried to defend the country, we might get somewhere. I don't think it is for lack of resources, but lack of principle that we are in this problem.
  - ficklepickle 6y ago
    The NSA has conflicting mandates. Better to think of them as two agencies, red team and blue team. Unfortunately too much red, not enough blue.
- fma 6y ago
  They don't need to create it...just have a variant of Linux. It's what the Chinese government does, and there's probably a good reason for it. However, as long as some Microsoft lobbyist can line the pockets of politicians, or politicians say it's "creating jobs" and government should not interfere w/ private sector business...it won't happen. https://en.wikipedia.org/wiki/Kylin_(operating_system) https://en.wikipedia.org/wiki/Kylin_(operating_system)

SSLy 6y ago

VMware is preoccupied with stealing Linux code, not fixing bugs.

jlgaddis 6y ago
Yep, it seems like 90% or more of "their" products are simply open-source code with a web-based front-end that they've slapped on (which is why I refuse to give them any money).

dannyw 6y ago

The federal government should not create its own operating system, or log system, but it should pour all of its resources into properly securing the systems it uses; weighted by its security risk. Systems running in root or hypervisor space deserve the most scrutiny and sandboxing. A JS app, less so, assuming its run in a secure sandboxed browser in a secure sandboxed operating system. Attack vectors like Intel ME must die. (There are already DoD- mandated high-assurance flags to disable parts of ME; but megabyte blobs running on ring -1 must go completely so we can secure ring 0).

brobdingnagians 6y ago
Isn't that what the NSA is supposed to do? They failed. They seem to have a big enough budget. I don't think they are incompetent. If they stopped stockpiling vulnerabilities and instead actually tried to defend the country, we might get somewhere. I don't think it is for lack of resources, but lack of principle that we are in this problem.
- ficklepickle 6y ago
  The NSA has conflicting mandates. Better to think of them as two agencies, red team and blue team. Unfortunately too much red, not enough blue.
fma 6y ago
They don't need to create it...just have a variant of Linux. It's what the Chinese government does, and there's probably a good reason for it. However, as long as some Microsoft lobbyist can line the pockets of politicians, or politicians say it's "creating jobs" and government should not interfere w/ private sector business...it won't happen. https://en.wikipedia.org/wiki/Kylin_(operating_system) https://en.wikipedia.org/wiki/Kylin_(operating_system)