3 ms·

JFC. This was an absolutely massive screwup by Microsoft. In addition to Bing and other MS services, it allowed access to "COSMOS: A file management system, man

JFC. This was an absolutely massive screwup by Microsoft. In addition to Bing and other MS services, it allowed access to "COSMOS: A file management system, managing over 4 exabytes (!) of Microsoft’s internal files." I would have added quite a few more exclamation marks myself. That bug should have gotten way more than a $40k bounty.

belter 4y ago
The $40k bounty for this type of vulnerability is the ultimate insult. Staying on Azure is on the border of being considered a firing offense...
- jimnotgym 4y ago
  > Staying on Azure is on the border of being considered a firing offense... If there was a competitor to AD that is. Right now developers and hn peeps have loads of options for their work, enterprises do not. I have Windows clients to authenticate, I need AD. I need forwards/ backwards compatibility on my clients, therefore I need Windows. I have applications that must run for several decades therefore I need Windows.
  - belter 4y ago
    Granted...but maybe you do not use all AD funcionality and you run it yourself instead of using Azure. Or look at some alternatives like... "Setting up Samba as an Active Directory Domain Controller" - https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Active_Directory_Domain_Controller https://wiki.samba.org/index.php/Setting_up_Samba_as_an_Acti...
  - Godel_unicode 4y ago
    This is a bug in AAD, which is a very different thing than AD. There is some interoperability between them (ok more than some) but needing AD for legacy auth doesn’t necessarily mean you need AAD for Oauth.
seedless-sensat 4y ago
I am pleasantly surprised that Wiz published that screenshot. It looks super confidential. What is the AIR business unit?