4 ms·

And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.

by dmvdoug 3y ago

TheRealDunkirk 3y ago
Yeah, this is really, really weird.
2OEH8eoCRo0 3y ago
Mentioning China negatively is the kiss of death.
- lacrimacida 3y ago
  On HN? I don’t see censored comments with China mentions and this thread has been visible yet very few comments. What sort of manipulation I’ve seen on HN is threads being flagged or drop from top 30 to top 240 within an hour. Im suspect intel agencies have some ability to tilt the scales here on HN.
- rightbyte 3y ago
  I feel I can't discuss some foreign nations anymore in a critical way since I fear giving mentally unstable war mongers ideas.
  - flangola7 3y ago
    What do you mean? I can't say I have ever seen war mongering on HN.
    - rightbyte 3y ago
      Ye true, I meant in general outside of HN. How news articles are used to push agendas etc. Like, I got this thing in the back of my mind reading about social injustice in some place that it is some push to build up pressure to bomb them.
formerly_proven 3y ago
This really surprised me when I learned of this story on the weekend. Very little discussion, very little reception in IT news. Someone hacked Azure AD[1] and accessed the data of 25+ orgs and the reaction is *crickets*? [1] I'm not exactly sure which Azure component was hacked and the MS communication seems intentionally unclear and obtuse on this. It sounds like the private keys of Azure-internal auth servers were stolen, but technically those private keys were not supposed to work for the accounts/orgs in question, except they did, and, in any case, MS doesn't disclose how the private keys (one? multiple?) of their cloud auth servers were stolen.
- coldpie 3y ago
  I saw the headline scroll by on my Ars Technica feed[1] but I admit I didn't bother to read it because there's like 10 major security breaches every single day. Just another one to add to the pile, there's more interesting things to read about. [1] https://arstechnica.com/security/2023/07/microsoft-takes-pains-to-obscure-role-in-0-days-that-caused-email-breach/ https://arstechnica.com/security/2023/07/microsoft-takes-pai...
- tgv 3y ago
  There was one issue where bing search results could be editted for any query by random users with an AAD account, and made to include a script that sends the Azure credentials of the user that happened to use that query to god-knows-where. And it wasn't the only service that was practically open. And another great thing: there were no logs. That's an amazingly big, world-wide security hole, and how much interest did it draw? Hey, look, there's a celebrity scandal over there.
- RVuRnvbM2e 3y ago
  This is not even the first time this year that Azure AD has been owned sideways. See this mind-blowing blog post from Wiz where they live edited bing.com search results, injected XSS into O365, accessed exabytes of internal MS file storage and more: https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration https://www.wiz.io/blog/azure-active-directory-bing-misconfi... I have no idea how Azure maintains its reputation as a safe enterprise choice. Microsoft really just has an almost impenetrable reputation I guess?
deleted 3y ago
[deleted]

And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.

TheRealDunkirk 3y ago

Yeah, this is really, really weird.

2OEH8eoCRo0 3y ago

Mentioning China negatively is the kiss of death.

lacrimacida 3y ago
On HN? I don’t see censored comments with China mentions and this thread has been visible yet very few comments. What sort of manipulation I’ve seen on HN is threads being flagged or drop from top 30 to top 240 within an hour. Im suspect intel agencies have some ability to tilt the scales here on HN.
rightbyte 3y ago
I feel I can't discuss some foreign nations anymore in a critical way since I fear giving mentally unstable war mongers ideas.
- flangola7 3y ago
  What do you mean? I can't say I have ever seen war mongering on HN.
  - rightbyte 3y ago
    Ye true, I meant in general outside of HN. How news articles are used to push agendas etc. Like, I got this thing in the back of my mind reading about social injustice in some place that it is some push to build up pressure to bomb them.

formerly_proven 3y ago

This really surprised me when I learned of this story on the weekend. Very little discussion, very little reception in IT news. Someone hacked Azure AD[1] and accessed the data of 25+ orgs and the reaction is *crickets*? [1] I'm not exactly sure which Azure component was hacked and the MS communication seems intentionally unclear and obtuse on this. It sounds like the private keys of Azure-internal auth servers were stolen, but technically those private keys were not supposed to work for the accounts/orgs in question, except they did, and, in any case, MS doesn't disclose how the private keys (one? multiple?) of their cloud auth servers were stolen.

coldpie 3y ago
I saw the headline scroll by on my Ars Technica feed[1] but I admit I didn't bother to read it because there's like 10 major security breaches every single day. Just another one to add to the pile, there's more interesting things to read about. [1] https://arstechnica.com/security/2023/07/microsoft-takes-pains-to-obscure-role-in-0-days-that-caused-email-breach/ https://arstechnica.com/security/2023/07/microsoft-takes-pai...
tgv 3y ago
There was one issue where bing search results could be editted for any query by random users with an AAD account, and made to include a script that sends the Azure credentials of the user that happened to use that query to god-knows-where. And it wasn't the only service that was practically open. And another great thing: there were no logs. That's an amazingly big, world-wide security hole, and how much interest did it draw? Hey, look, there's a celebrity scandal over there.
RVuRnvbM2e 3y ago
This is not even the first time this year that Azure AD has been owned sideways. See this mind-blowing blog post from Wiz where they live edited bing.com search results, injected XSS into O365, accessed exabytes of internal MS file storage and more: https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration https://www.wiz.io/blog/azure-active-directory-bing-misconfi... I have no idea how Azure maintains its reputation as a safe enterprise choice. Microsoft really just has an almost impenetrable reputation I guess?

deleted 3y ago

[deleted]