5 ms·

I'm curious if Microsoft is suffering from a massive loss of generational expertise. At least right after XP we had to go through a security standdown where all

I'm curious if Microsoft is suffering from a massive loss of generational expertise. At least right after XP we had to go through a security standdown where all code was reviewed and audited throughout the company. Subsequent features and services had to go through a pretty thorough security review at design time as well. Over the past few years the number of security fiascos has been increasing. Is the internal Security team (forget what the org was called) dead now ? I'm sure lack of dedicated testing is also a major factor, but do launches no longer have to satisfy a security review ? Maybe in the name of agile development ?

foepys 5y ago
I'm wondering about this, too. There are so many things being redone from scratch that I'm scratching my head about the why. Maybe Microsoft lost so many engineers from the 90s that they don't have the people anymore that understand the old code.
- ta988 5y ago
  The problem here is due to a lack of basic security practices. There is nothing related to old code, it is brand new code and infrastructure that was deployed without audit.
- pmlnr 5y ago
  Understanding old code rarely gets one promotions.
  - welkie 5y ago
    Somehow, it's gotten me promotions and raises. I feel like I'm lucky and should stick around.
stingraycharles 5y ago
At the time of XP, Microsoft had a fierce monopoly in the world and was absolutely dominating. I wouldn’t be surprised if they started embracing the “ship fast” mentality with the cloud a bit more over the past years, in order to corner the market more quickly (which they did). Additionally, I can also imagine that the release processes for cloud are fundamentally different than something like an OS. With the cloud, there’s a much larger mentality of releasing often, and it may be difficult to translate rigorous security audits to this workflow.
bink 5y ago
I think this is more of an industry problem than a Microsoft problem. This was a feature added onto an existing service. The old waterfall method of security approvals might have caught this, but for most orgs that has gone the way of the dodo (and probably for the better). Cosmos DB probably went through security review during the design phase and then again regularly as the code was written and improved. The Jupyter notebook functionality was also likely reviewed by security teams during the design, testing, and implementation phases. But once you're through those approvals most security review is going to be done via automated tooling with only occasional re-reviews and penetration testing at scheduled intervals. Automated testing is great at detecting vulnerabilities that have been discovered in the past, but really not good at detecting new classes of vulnerabilities, hard-to-detect authorization vulnerabilities, or how code integrates with other services. Once the initial approval and code reviews had been done developers would still be committing code to the service and each line of code is probably not receiving a manual code review. Vulnerabilities like this are hard to detect even with a manual review as the testing team may not have great knowledge of all interconnected services, especially if it's an outside vendor.
- mistrial9 5y ago
  this sounds reasonable but, in this case stealing a key and using it for a man-in-the-middle attack, is what happened
  - bink 5y ago
    Ah, really? Where did you find that info?
Wistar 5y ago
One thing: Given the rise of MS stock in the recent past and the pandemic, I have seen many long-time MS folks decide to retire, especially in the last 10–12 months.
redwood 5y ago
One thing is for sure, putting its astronomical revenue growth on the side, which presumably involves some fuzzy math... Azure is definitely the worst of the big three cloud providers
- gatvol 5y ago
  AZURE seems to be trying to play catch up -at least in feature parity - with AWS and to some extent GCP. IMO this sort of outcome is inevitable when moving at speed. While they do seem to have some sort of feature parity (on the tin type) and some good ideas, many of the services they have a pretty half baked once you scratch the surface, plus they're expensive.
riho 5y ago
Is it possible that there's also just more software in different domains being written, hence making it more difficult to keep track of everything that is going on?
- muststopmyths 5y ago
  Shouldn't be. If I recall correctly, the process was fairly logical. One of the things you wrote down in your design doc was all the external surfaces (endpoints) your application/service had and how you were securing them. You could literally not ship anything without this review, so they must have abandoned the process by now. Or just never extended it to "the cloud"
AzzieElbab 5y ago
After reading into details, this sounds like a fundamental design flow that was made easily exploitable via a new feature
Wistar 5y ago
"The 8 most important execs who left Microsoft in 2021, and 3 new power players who joined" https://www.flexi-news.com/the-8-most-important-execs-who-left-microsoft-in-2021-and-3-new-power-players-who-joined/ https://www.flexi-news.com/the-8-most-important-execs-who-le...

foepys 5y ago

I'm wondering about this, too. There are so many things being redone from scratch that I'm scratching my head about the why. Maybe Microsoft lost so many engineers from the 90s that they don't have the people anymore that understand the old code.

ta988 5y ago
The problem here is due to a lack of basic security practices. There is nothing related to old code, it is brand new code and infrastructure that was deployed without audit.
pmlnr 5y ago
Understanding old code rarely gets one promotions.
- welkie 5y ago
  Somehow, it's gotten me promotions and raises. I feel like I'm lucky and should stick around.

stingraycharles 5y ago

At the time of XP, Microsoft had a fierce monopoly in the world and was absolutely dominating. I wouldn’t be surprised if they started embracing the “ship fast” mentality with the cloud a bit more over the past years, in order to corner the market more quickly (which they did). Additionally, I can also imagine that the release processes for cloud are fundamentally different than something like an OS. With the cloud, there’s a much larger mentality of releasing often, and it may be difficult to translate rigorous security audits to this workflow.

bink 5y ago

I think this is more of an industry problem than a Microsoft problem. This was a feature added onto an existing service. The old waterfall method of security approvals might have caught this, but for most orgs that has gone the way of the dodo (and probably for the better). Cosmos DB probably went through security review during the design phase and then again regularly as the code was written and improved. The Jupyter notebook functionality was also likely reviewed by security teams during the design, testing, and implementation phases. But once you're through those approvals most security review is going to be done via automated tooling with only occasional re-reviews and penetration testing at scheduled intervals. Automated testing is great at detecting vulnerabilities that have been discovered in the past, but really not good at detecting new classes of vulnerabilities, hard-to-detect authorization vulnerabilities, or how code integrates with other services. Once the initial approval and code reviews had been done developers would still be committing code to the service and each line of code is probably not receiving a manual code review. Vulnerabilities like this are hard to detect even with a manual review as the testing team may not have great knowledge of all interconnected services, especially if it's an outside vendor.

mistrial9 5y ago
this sounds reasonable but, in this case stealing a key and using it for a man-in-the-middle attack, is what happened
- bink 5y ago
  Ah, really? Where did you find that info?

Wistar 5y ago

One thing: Given the rise of MS stock in the recent past and the pandemic, I have seen many long-time MS folks decide to retire, especially in the last 10–12 months.

redwood 5y ago

One thing is for sure, putting its astronomical revenue growth on the side, which presumably involves some fuzzy math... Azure is definitely the worst of the big three cloud providers

gatvol 5y ago
AZURE seems to be trying to play catch up -at least in feature parity - with AWS and to some extent GCP. IMO this sort of outcome is inevitable when moving at speed. While they do seem to have some sort of feature parity (on the tin type) and some good ideas, many of the services they have a pretty half baked once you scratch the surface, plus they're expensive.

riho 5y ago

Is it possible that there's also just more software in different domains being written, hence making it more difficult to keep track of everything that is going on?

muststopmyths 5y ago
Shouldn't be. If I recall correctly, the process was fairly logical. One of the things you wrote down in your design doc was all the external surfaces (endpoints) your application/service had and how you were securing them. You could literally not ship anything without this review, so they must have abandoned the process by now. Or just never extended it to "the cloud"

AzzieElbab 5y ago

After reading into details, this sounds like a fundamental design flow that was made easily exploitable via a new feature

Wistar 5y ago

"The 8 most important execs who left Microsoft in 2021, and 3 new power players who joined" https://www.flexi-news.com/the-8-most-important-execs-who-left-microsoft-in-2021-and-3-new-power-players-who-joined/ https://www.flexi-news.com/the-8-most-important-execs-who-le...