5 ms·

Microsoft was aware of the vulns for 2 months before issuing a patch. Some of the vulns existed in the Exchange codebase for 10 years. Microsoft faces pervers

Microsoft was aware of the vulns for 2 months before issuing a patch. Some of the vulns existed in the Exchange codebase for 10 years. Microsoft faces perverse incentives. When their customers get compromised, Microsoft benefits from accelerated upgrades and cloud subscriptions. Yet their customers blame foreign threat actors and not Microsoft, so Microsoft suffers no reputational damage. With these incentives, why would any rational corporation spend resources hardening their software or responding rapidly to new disclosures?

derivagral 6y ago
I guess I have 2 questions for you. First: what if the fix really took 2 months? Second: I'm not well versed in this kind of software; is this on-prem stuff that clients have to manage (update) themselves, or is this SaaS cloud stuff that MS can immediately update without clients in the loop?
- ianhawes 6y ago
  This is Exchange Server, entirely on-premise that must be updated by clients.
- 1vuio0pswjnm7 6y ago
  If the fix took two months I would say that is not confidence-inspiring. Consider the enormous financial reserves at their disposal.
klingon78 6y ago
In Microsoft’s defense, most organizations have security vulnerabilities in their code that all may or may not be aware of. Just because Microsoft has software powering very important things globally doesn’t exclude them.
Lammy 6y ago
Some of the “foreign threat actors” are also major Microsoft customers.
1vuio0pswjnm7 6y ago
If somone commented "Stop picking on Microsoft", how would you respond, if you chose to respond. With these incentives, why would any rational government spend taxpayer money on this company's software.
- jjk166 6y ago
  Would you switch your vote to the opposite party because your party used microsoft software or because the other party promised they wouldn't? If not then what incentive does a rational government have to avoid using this software?
  - 1vuio0pswjnm7 6y ago
    If a party candidate pledged to address quality control problems with software or "tech" companies such as Microsoft, then yes, that could potentially influence my vote. The canned response for every problem with Microsoft today seems to be "Well, nothing more can be done, except what Microsoft (and other "experts") tells us to do." The company that creates the problems is deemed to be the only one who could ever attempt to solve them. This is pure nonsense. With few exceptions, this goes virtually unquestioned, The "experts" have perverse incentives. Business is good just the way it is. If problems are actuallly solved, business would likely decline.
wuwuno 6y ago
Publicly available software suffers from the fact that millions and millions of people can poke and prod at the software in ways that the manufacture can't due to resource and time constraints driven by the need to generate revenue. Microsoft runs their software through multiple code scanners looking for weakneses. Developers do unit testing, and then there is acceptance testing. Microsoft conducts internal penetration tests on their software. Microsoft hires 3rd parties to conduct penetration tests on their software. Large corporations conduct internal penetration tests on Exchange, and hire 3rd party companies to conduct penetration tests on Exchange, just to be sure. Governments conduct penetration tests on Exchange. A lot of people have been poking at Exchange for years, and years, and years, and this bug was just discovered, and it's been present in the code base for at least 7 years, I'd say that's pretty damn good, it seems like a hardened product to me, not a slipshod product as you suggest. You are so funny. First you complain that Microsoft has no incentive to deliver quality software, then you complain that they can't delivery quality software quickly. I guess they would have been better off not bother to conduct all the testing necessary to ensure that they didn't fix one problem and create two more.
de6u99er 6y ago
It's kind of funny how Microsoft akways gets away with it.
Lendal 6y ago
Everyone asks why it takes 2 months to develop, test and deploy a patch. Nobody ever asks why it took over 10 years for criminals to find and exploit this bug. What were they doing all this time? Why did it take them so long? Do criminals have perverse incentives to be law-abiding or are they just plain lazy?

derivagral 6y ago

I guess I have 2 questions for you. First: what if the fix really took 2 months? Second: I'm not well versed in this kind of software; is this on-prem stuff that clients have to manage (update) themselves, or is this SaaS cloud stuff that MS can immediately update without clients in the loop?

ianhawes 6y ago
This is Exchange Server, entirely on-premise that must be updated by clients.
1vuio0pswjnm7 6y ago
If the fix took two months I would say that is not confidence-inspiring. Consider the enormous financial reserves at their disposal.

klingon78 6y ago

In Microsoft’s defense, most organizations have security vulnerabilities in their code that all may or may not be aware of. Just because Microsoft has software powering very important things globally doesn’t exclude them.

Lammy 6y ago

Some of the “foreign threat actors” are also major Microsoft customers.

1vuio0pswjnm7 6y ago

If somone commented "Stop picking on Microsoft", how would you respond, if you chose to respond. With these incentives, why would any rational government spend taxpayer money on this company's software.

jjk166 6y ago
Would you switch your vote to the opposite party because your party used microsoft software or because the other party promised they wouldn't? If not then what incentive does a rational government have to avoid using this software?
- 1vuio0pswjnm7 6y ago
  If a party candidate pledged to address quality control problems with software or "tech" companies such as Microsoft, then yes, that could potentially influence my vote. The canned response for every problem with Microsoft today seems to be "Well, nothing more can be done, except what Microsoft (and other "experts") tells us to do." The company that creates the problems is deemed to be the only one who could ever attempt to solve them. This is pure nonsense. With few exceptions, this goes virtually unquestioned, The "experts" have perverse incentives. Business is good just the way it is. If problems are actuallly solved, business would likely decline.

wuwuno 6y ago

Publicly available software suffers from the fact that millions and millions of people can poke and prod at the software in ways that the manufacture can't due to resource and time constraints driven by the need to generate revenue. Microsoft runs their software through multiple code scanners looking for weakneses. Developers do unit testing, and then there is acceptance testing. Microsoft conducts internal penetration tests on their software. Microsoft hires 3rd parties to conduct penetration tests on their software. Large corporations conduct internal penetration tests on Exchange, and hire 3rd party companies to conduct penetration tests on Exchange, just to be sure. Governments conduct penetration tests on Exchange. A lot of people have been poking at Exchange for years, and years, and years, and this bug was just discovered, and it's been present in the code base for at least 7 years, I'd say that's pretty damn good, it seems like a hardened product to me, not a slipshod product as you suggest. You are so funny. First you complain that Microsoft has no incentive to deliver quality software, then you complain that they can't delivery quality software quickly. I guess they would have been better off not bother to conduct all the testing necessary to ensure that they didn't fix one problem and create two more.

de6u99er 6y ago

It's kind of funny how Microsoft akways gets away with it.

Lendal 6y ago

Everyone asks why it takes 2 months to develop, test and deploy a patch. Nobody ever asks why it took over 10 years for criminals to find and exploit this bug. What were they doing all this time? Why did it take them so long? Do criminals have perverse incentives to be law-abiding or are they just plain lazy?