4 ms·

If someone robbed your apartment would it be convenient to accuse you of low-security procedures instead of condemning the bad actors

by jimmy2020 5y ago

aww_dang 5y ago
If the property management company demanded that I use Insecure Brand locks on my front door, I'd have an issue with that. Of course that wouldn't excuse the robbers, but continuing to use Insecure Brand locks wouldn't be advisable. I'd also take exception if IB Locks or the property management company marketed themselves as a security oriented company.
- jimmy2020 5y ago
  > continuing to use Insecure Brand locks wouldn't be advisable. Agreed. Microsoft should clarify how this happened and what measurements will take to prevent this incident from happening again. Still, the problem is with robbery and it should be condemned. Why changing the subject to Microsoft? I don't think whataboutism is the valid argument here.
  - A4ET8a8uTh0 5y ago
    It is not whataboutism. It is about 3 decades of seemingly intentional inability to deliver secure product on the mildly evil calculation that the subscriber will need 'security updates' and 'support'. There is a good argument to be made that Windows is a big target, but they should at least try not making it so easy.
    - jimmy2020 5y ago
      > It is about 3 decades of seemingly intentional inability to deliver secure product. This is a consumer choice. You don't trust Microsoft, you don't use its services. On the government level, you ask for regulations if the situation is escalated (if necessary). But dealing with global cyberattacks is not Microsoft problem and it's not connected to one company or one service. It's an international responsibility to act and establish a framework that prevents such attacks.
      - Woodi 5y ago
        Look, you could be right in... usual case. But we speaking freaking NATO here !!!!! Do you attach string to hand granade and hand other side to your adversary ? And then argue that someone pulled it ?? Microsoft Windows and Microsoft Exchange is SYNONYM to "security HOLE" ! So tell me - why customer NATO _choose_ to use this ?
        jimmy2020 5y ago
        I don't think NATO has any value here. It's a signal of unity not just to China but to Russia. This is how Biden admin defines "America is back". So it might be aggressive but actually, it's a unity message. Us, the allies, against them the adversaries.
      - A4ET8a8uTh0 5y ago
        Just the other day I was listening to a radio show ( further right than shown in mainstream ), where a user was clamoring for a proper locked down version of Windows where nothing can go wrong. The current situation ( and the resulting clamoring ) is absolutely a direct result of people who create this software. Trying to shift the blame onto nonexistent framework is at best laughable and at worst very deceptive. It absolves MS and its engineers from guilt associated with it. To put it another way, if those engineers were bridge engineers, we would now be witnessing multiple collapses with swathes of engineers arguing that it is not their fault as 'there is an international responsibility to act and establish a framework' that prevents bridges from falling apart. I am sorry. I do not buy this defense. As an architect, you should know better.
        jimmy2020 5y ago
        You have a valid point. I am not arguing against it. I was trying to say discussing how MS deals with the subject is not the point. But after reading your recent comment, well, I guess we should talk more about MS failure.
        jimmy2020 5y ago
        I don't know if you gonna read this, but I should give a credit for your take on the subject. This is what you were talking about: https://edwardsnowden.substack.com/p/ns-oh-god-how-is-this-legal https://edwardsnowden.substack.com/p/ns-oh-god-how-is-this-l...
TeMPOraL 5y ago
A better analogy would be, if you were a company selling doors - after a string of break-ins involving some group casually walking through your products like they weren't there, somebody would eventually start asking about your responsibility. (Maybe "cyber insurance" needs to be a thing in the SMB world? As much as I feel it's currently mostly nonsense, maybe it's serviceable. In the physical world, it seems the driving force behind buying security measures is not the (unlikely) possibility of being a victim of a break-in, but the (more likely) possibility of not getting insurance to cover it.)
- gruez 5y ago
  >A better analogy would be, if you were a company selling doors - after a string of break-ins involving some group casually walking through your products like they weren't there, somebody would eventually start asking about your responsibility. Actually most locks are susceptible to being picked (ie. a known exploit), so what you're describing is already the case, minus the lawsuits.
  - ratww 5y ago
    Locks being susceptible to lock picking actually turns into a feature when, for example, you're locked out or lose your keys: you just call a locksmith and they pick it for you. There's no perfect security in the real world.
- jimmy2020 5y ago
  You can't sell doors unless there's clear low enforcement that prohibited criminal activities. You need an environment to operate.
  - aww_dang 5y ago
    https://en.wikipedia.org/wiki/Portcullis https://en.wikipedia.org/wiki/Portcullis
    - jimmy2020 5y ago
apercu 5y ago
I get your metaphor but I don't think it meets the situation. If you were paying a security guard to watch your apartment and they instead went to guard some other place for additional money for 2 hours and then your apartment got robbed, well, that security guard is Microsoft in this example.
marcosdumay 5y ago
If you brought a security door, and the thieves just had to knock on it on the right frequency to open, yes, you would accuse the door seller of fraud.
- dahfizz 5y ago
  Locks get picked literally all the time, and nobody sues lock makers. Perfect security does not exist.
  - aww_dang 5y ago
    Security can never be perfect. However negligence, bloat and poor design decisions are still a thing. The ideas are not mutually exclusive.
    - dahfizz 5y ago
      And you can confidently claim that Microsoft was negligent here? You have in depth knowledge of their architecture decisions? How confident are you that you could write an email server that could withstand extended attacks from nation states?
      - aww_dang 5y ago
        So if I personally haven't written an email server, then I shouldn't criticize MS Exchange? How would that work for something like a Boeing 737 max? Yes, I am confident I could process text over the network without (42) remote code execution vulns. https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-194/opec-1/Microsoft-Exchange-Server.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p... >Microsoft revealed that these vulnerabilities had existed for around 10 years https://en.wikipedia.org/wiki/Microsoft_Exchange_Server#Vulnerabilities_and_hacks https://en.wikipedia.org/wiki/Microsoft_Exchange_Server#Vuln...

If someone robbed your apartment would it be convenient to accuse you of low-security procedures instead of condemning the bad actors

aww_dang 5y ago

If the property management company demanded that I use Insecure Brand locks on my front door, I'd have an issue with that. Of course that wouldn't excuse the robbers, but continuing to use Insecure Brand locks wouldn't be advisable. I'd also take exception if IB Locks or the property management company marketed themselves as a security oriented company.

jimmy2020 5y ago
> continuing to use Insecure Brand locks wouldn't be advisable. Agreed. Microsoft should clarify how this happened and what measurements will take to prevent this incident from happening again. Still, the problem is with robbery and it should be condemned. Why changing the subject to Microsoft? I don't think whataboutism is the valid argument here.
- A4ET8a8uTh0 5y ago
  It is not whataboutism. It is about 3 decades of seemingly intentional inability to deliver secure product on the mildly evil calculation that the subscriber will need 'security updates' and 'support'. There is a good argument to be made that Windows is a big target, but they should at least try not making it so easy.
  - jimmy2020 5y ago
    > It is about 3 decades of seemingly intentional inability to deliver secure product. This is a consumer choice. You don't trust Microsoft, you don't use its services. On the government level, you ask for regulations if the situation is escalated (if necessary). But dealing with global cyberattacks is not Microsoft problem and it's not connected to one company or one service. It's an international responsibility to act and establish a framework that prevents such attacks.
    - Woodi 5y ago
      Look, you could be right in... usual case. But we speaking freaking NATO here !!!!! Do you attach string to hand granade and hand other side to your adversary ? And then argue that someone pulled it ?? Microsoft Windows and Microsoft Exchange is SYNONYM to "security HOLE" ! So tell me - why customer NATO _choose_ to use this ?
      - jimmy2020 5y ago
        I don't think NATO has any value here. It's a signal of unity not just to China but to Russia. This is how Biden admin defines "America is back". So it might be aggressive but actually, it's a unity message. Us, the allies, against them the adversaries.
    - A4ET8a8uTh0 5y ago
      Just the other day I was listening to a radio show ( further right than shown in mainstream ), where a user was clamoring for a proper locked down version of Windows where nothing can go wrong. The current situation ( and the resulting clamoring ) is absolutely a direct result of people who create this software. Trying to shift the blame onto nonexistent framework is at best laughable and at worst very deceptive. It absolves MS and its engineers from guilt associated with it. To put it another way, if those engineers were bridge engineers, we would now be witnessing multiple collapses with swathes of engineers arguing that it is not their fault as 'there is an international responsibility to act and establish a framework' that prevents bridges from falling apart. I am sorry. I do not buy this defense. As an architect, you should know better.
      - jimmy2020 5y ago
        You have a valid point. I am not arguing against it. I was trying to say discussing how MS deals with the subject is not the point. But after reading your recent comment, well, I guess we should talk more about MS failure.
      - jimmy2020 5y ago
        I don't know if you gonna read this, but I should give a credit for your take on the subject. This is what you were talking about: https://edwardsnowden.substack.com/p/ns-oh-god-how-is-this-legal https://edwardsnowden.substack.com/p/ns-oh-god-how-is-this-l...

TeMPOraL 5y ago

A better analogy would be, if you were a company selling doors - after a string of break-ins involving some group casually walking through your products like they weren't there, somebody would eventually start asking about your responsibility. (Maybe "cyber insurance" needs to be a thing in the SMB world? As much as I feel it's currently mostly nonsense, maybe it's serviceable. In the physical world, it seems the driving force behind buying security measures is not the (unlikely) possibility of being a victim of a break-in, but the (more likely) possibility of not getting insurance to cover it.)

gruez 5y ago
>A better analogy would be, if you were a company selling doors - after a string of break-ins involving some group casually walking through your products like they weren't there, somebody would eventually start asking about your responsibility. Actually most locks are susceptible to being picked (ie. a known exploit), so what you're describing is already the case, minus the lawsuits.
- ratww 5y ago
  Locks being susceptible to lock picking actually turns into a feature when, for example, you're locked out or lose your keys: you just call a locksmith and they pick it for you. There's no perfect security in the real world.
jimmy2020 5y ago
You can't sell doors unless there's clear low enforcement that prohibited criminal activities. You need an environment to operate.
- aww_dang 5y ago
  https://en.wikipedia.org/wiki/Portcullis https://en.wikipedia.org/wiki/Portcullis
  - jimmy2020 5y ago

apercu 5y ago

I get your metaphor but I don't think it meets the situation. If you were paying a security guard to watch your apartment and they instead went to guard some other place for additional money for 2 hours and then your apartment got robbed, well, that security guard is Microsoft in this example.

marcosdumay 5y ago

If you brought a security door, and the thieves just had to knock on it on the right frequency to open, yes, you would accuse the door seller of fraud.

dahfizz 5y ago
Locks get picked literally all the time, and nobody sues lock makers. Perfect security does not exist.
- aww_dang 5y ago
  Security can never be perfect. However negligence, bloat and poor design decisions are still a thing. The ideas are not mutually exclusive.
  - dahfizz 5y ago
    And you can confidently claim that Microsoft was negligent here? You have in depth knowledge of their architecture decisions? How confident are you that you could write an email server that could withstand extended attacks from nation states?
    - aww_dang 5y ago
      So if I personally haven't written an email server, then I shouldn't criticize MS Exchange? How would that work for something like a Boeing 737 max? Yes, I am confident I could process text over the network without (42) remote code execution vulns. https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-194/opec-1/Microsoft-Exchange-Server.html https://www.cvedetails.com/vulnerability-list/vendor_id-26/p... >Microsoft revealed that these vulnerabilities had existed for around 10 years https://en.wikipedia.org/wiki/Microsoft_Exchange_Server#Vulnerabilities_and_hacks https://en.wikipedia.org/wiki/Microsoft_Exchange_Server#Vuln...