5 ms·

Ironically, the OMI 'open source' package is Microsoft's. The only recent commit was for "Enhanced security" a month ago: https://github.com/microsoft/omi/com

Ironically, the OMI 'open source' package is Microsoft's. The only recent commit was for "Enhanced security" a month ago: https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb9...

jahewson 5y ago
Indeed! And most of the 20 contributors work for Microsoft. Talk about FUD.
blibble 5y ago
I read all of this: https://github.com/microsoft/omi/blob/master/README.md https://github.com/microsoft/omi/blob/master/README.md still don't understand what it does
- mook 5y ago
  Ars Technica had an article on three vulnerability that was decently clear: https://arstechnica.com/information-technology/2021/09/security-researchers-at-wiz-discover-another-major-azure-vulnerability/ https://arstechnica.com/information-technology/2021/09/secur... (Sounds like it's a Linux port of some Windows management feature.)
  - hughrr 5y ago
    This is one reason I stay the hell away from Windows focused software on Linux. There’s a complete impedance mismatch. Also MSFT’s GitHub open source fairy dust project stewardship is a shit show from experience.
- q3k 5y ago
  It’s part of dumpster fire that is the DMTF ecosystem. Attempting to understand it if you haven’t been exposed to Windows enterprise bullshit is futile. It’s layers upon layers of meta XML to do the most mundane things in the most overcomplicated way without actually succeeding at making any usable standard. Or, in other words: if you reaction to SOAP was “damn, this is amazing, we need more of this but with even more indirection”, you’ll feel right at home.
matja 5y ago
yes, checking the secret before setting the uid/gid does seem like "Enhanced security" : https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa#diff-7d4213da6be8b9fe8aeb48c3bb723980b881e8a89f678d0c2ef7b637bd14b3d5R699 https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb9...

jahewson 5y ago

Indeed! And most of the 20 contributors work for Microsoft. Talk about FUD.

blibble 5y ago

I read all of this: https://github.com/microsoft/omi/blob/master/README.md https://github.com/microsoft/omi/blob/master/README.md still don't understand what it does

mook 5y ago
Ars Technica had an article on three vulnerability that was decently clear: https://arstechnica.com/information-technology/2021/09/security-researchers-at-wiz-discover-another-major-azure-vulnerability/ https://arstechnica.com/information-technology/2021/09/secur... (Sounds like it's a Linux port of some Windows management feature.)
- hughrr 5y ago
  This is one reason I stay the hell away from Windows focused software on Linux. There’s a complete impedance mismatch. Also MSFT’s GitHub open source fairy dust project stewardship is a shit show from experience.
q3k 5y ago
It’s part of dumpster fire that is the DMTF ecosystem. Attempting to understand it if you haven’t been exposed to Windows enterprise bullshit is futile. It’s layers upon layers of meta XML to do the most mundane things in the most overcomplicated way without actually succeeding at making any usable standard. Or, in other words: if you reaction to SOAP was “damn, this is amazing, we need more of this but with even more indirection”, you’ll feel right at home.

matja 5y ago

yes, checking the secret before setting the uid/gid does seem like "Enhanced security" : https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb934c5acc3f4d6a6796bfa#diff-7d4213da6be8b9fe8aeb48c3bb723980b881e8a89f678d0c2ef7b637bd14b3d5R699 https://github.com/microsoft/omi/commit/4ce2cf1cb0aa656b8eb9...