5 ms·

The issue is not that a random guy on the internet hacks the software, but a _state_ actor.

aww_dang 5y ago
The solution is the same in both cases. Don't use vulnerable software. The problem starts with the same actor in both cases, Microsoft. I feel bad for the admins who are stuck with these systems.
- ChemSpider 5y ago
  So you think that a Linux mail server is unhackable for a state actor?
  - apercu 5y ago
    Lol. Love it. Don't use Microsoft, instead become an expert in cisco OS and Linux and don't spend ay time generating anything of economic value but instead spend all your time securing your infrastructure and doing pen tests. (yes, if you are expert open source is easier top secure maybe, at least that was my experience 20+ years ago. Now I mostly pay companies like microsoft to host my stuff so I can do billable shit).
  - aww_dang 5y ago
    Nothing is perfect. I'm sure nobody here is proposing that. However the lack of perfect alternatives doesn't excuse Microsoft's or specifically MS Exchange's reputation. https://en.wikipedia.org/wiki/Nirvana_fallacy https://en.wikipedia.org/wiki/Nirvana_fallacy https://www.cvedetails.com/product/194/Microsoft-Exchange-Server.html?vendor_id=26 https://www.cvedetails.com/product/194/Microsoft-Exchange-Se...
- ahiknsr 5y ago
  > Don't use vulnerable software Is there any widely used software that doesn't have any vulnerabilities?
- AnIdiotOnTheNet 5y ago
  > The solution is the same in both cases. Don't use vulnerable software. So, basically, don't use software. Actually, given the horrific state of modern software, I can get behind that.
  - aww_dang 5y ago
    You digress, but you're onto something here. I suspect I'm not the only one who cringes at bloated packages and sometimes rolls my own alternative.
    - therealEleix 5y ago
      This is sadly true. We need to return back to the Unix Philosophy of do one thing and do it well. None of these multi-purpose tools that have terrible feature creep and try to take over everything cough systemd cough. In all seriousness though, a lot of software that should be simple and easy to audit ends up having all these dependencies that are ether no longer maintained or doesn't get the necessary code reviews and it isn't until stuff like this happens that it actually comes to light. I'm all for re-using code when rebuilding the wheel would be a hassle but it has to be balanced with proper code review before it should be included. Developers are much too quick to include outside code with the assumption that other people have already done the necessary reviews and this is where a lot of devs are getting bit.
    - maximus-decimus 5y ago
      They're not digressing. There is no such thing as not vulnerable software. Especially if the attacker is the government of one of the most powerful nations on Earth.
aj3 5y ago
Eh, the issue was found by a random (Chinese) guy on the internet. And it was reported to Microsoft in the beginning of January. It got leaked and once you have the exploit chain - yeah, pretty much any random guy on the internet could use it for hacking. A few days after MS disclosure there were in fact independently produced exploits by other random guys.

The solution is the same in both cases. Don't use vulnerable software. The problem starts with the same actor in both cases, Microsoft. I feel bad for the admins who are stuck with these systems.

ChemSpider 5y ago
So you think that a Linux mail server is unhackable for a state actor?
- apercu 5y ago
  Lol. Love it. Don't use Microsoft, instead become an expert in cisco OS and Linux and don't spend ay time generating anything of economic value but instead spend all your time securing your infrastructure and doing pen tests. (yes, if you are expert open source is easier top secure maybe, at least that was my experience 20+ years ago. Now I mostly pay companies like microsoft to host my stuff so I can do billable shit).
- aww_dang 5y ago
  Nothing is perfect. I'm sure nobody here is proposing that. However the lack of perfect alternatives doesn't excuse Microsoft's or specifically MS Exchange's reputation. https://en.wikipedia.org/wiki/Nirvana_fallacy https://en.wikipedia.org/wiki/Nirvana_fallacy https://www.cvedetails.com/product/194/Microsoft-Exchange-Server.html?vendor_id=26 https://www.cvedetails.com/product/194/Microsoft-Exchange-Se...
ahiknsr 5y ago
> Don't use vulnerable software Is there any widely used software that doesn't have any vulnerabilities?
AnIdiotOnTheNet 5y ago
> The solution is the same in both cases. Don't use vulnerable software. So, basically, don't use software. Actually, given the horrific state of modern software, I can get behind that.
- aww_dang 5y ago
  You digress, but you're onto something here. I suspect I'm not the only one who cringes at bloated packages and sometimes rolls my own alternative.
  - therealEleix 5y ago
    This is sadly true. We need to return back to the Unix Philosophy of do one thing and do it well. None of these multi-purpose tools that have terrible feature creep and try to take over everything cough systemd cough. In all seriousness though, a lot of software that should be simple and easy to audit ends up having all these dependencies that are ether no longer maintained or doesn't get the necessary code reviews and it isn't until stuff like this happens that it actually comes to light. I'm all for re-using code when rebuilding the wheel would be a hassle but it has to be balanced with proper code review before it should be included. Developers are much too quick to include outside code with the assumption that other people have already done the necessary reviews and this is where a lot of devs are getting bit.
  - maximus-decimus 5y ago
    They're not digressing. There is no such thing as not vulnerable software. Especially if the attacker is the government of one of the most powerful nations on Earth.

aj3 5y ago

Eh, the issue was found by a random (Chinese) guy on the internet. And it was reported to Microsoft in the beginning of January. It got leaked and once you have the exploit chain - yeah, pretty much any random guy on the internet could use it for hacking. A few days after MS disclosure there were in fact independently produced exploits by other random guys.