4 ms·
>That's insane for a company the size of Microsoft. Why? Why does company size have anything at all to do with the security of their product? Microsoft has b
by midoridensha 3y ago
>That's insane for a company the size of Microsoft.
Why? Why does company size have anything at all to do with the security of their product?
Microsoft has been making shoddy, horribly insecure products for decades now. Do you need me to list all the email viruses and other such things that were running rampant in the 90s and 2000s?
What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. The common saying is "the definition of insanity is doing the same thing and expecting a different result", and that's exactly what most people do in regards to Microsoft and product quality or security.
- insanitybit 3y ago> Why? Why does company size have anything at all to do with the security of their product? Because they have a massive security team. Size has a lot to do with security. > What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't. Microsoft has done a ton of impressive security work when it comes to Windows, they've really stepped up their game. They've invested quite heavily.
- devwastaken 3y agoMore cooks ensures you get the same terrible burger in triplicate.
- insanitybit 3y agoNo. Security teams need staff.
- bagacrap 3y agoSize is correlated with resources. Microsoft should have the resources to throw at this problem. Unfortunately the Microsoft approach to software engineering is to set a bunch of monkeys loose on a room full of keyboards, rather than to spend their considerable resources vying for top talent. (Obviously they do have some good engineers, no offense if you're one of them, it's simply that from my sample size of 5, 80% were just warm bodies with email access.)
- dreamcompiler 3y agoOf course they have the resources. What they don't have is the incentives to do better. Just like every other big company that has a breach, they are not punished when they ignore basic security and they are not rewarded for paying attention to it. In fact they are punished by Wall Street for paying attention to it, because that costs money. As long as all they have to do is say "Whoops! We're sorry" when a breach happens, we should expect breaches to be the norm for all big companies.
- insanitybit 3y agoThey definitely have the incentives. This conversation is a good example of that. Azure is attempting to compete in an aggressively competitive market and their customers absolutely care about security.
- bagacrap 3y agoHopefully a news item as large as this one will cause them to lose some contracts, at least at the margin.
- hulitu 3y agoYou expect too much from Sales and CIOs/CEOs. Most of them have no idea what this is, but they make the decision to buy SW products.
- BLKNSLVR 3y ago> Of course they have the resources. What they don't have is the incentives to do better. Off-topic: this is exactly the same reason that Google offers up ads for scams and ads containing or linking to malware on their own advertising network. The only way to get to the size of these companies is to scale what can be scaled, and damn the rest until the pigeons come home to roost. Which, if they play their political-donation cards right, won't happen. And if it does, jeez they've made bank in the meantime, and will Goodhart the shit out of whatever watered-down legislational changes may make their way through.
- 3y ago
- nvy 3y ago>Why? Why does company size have anything at all to do with the security of their product? Because they have the money to hire people who know what they're doing, though it seems they are having difficulty selecting the right candidates.
- midoridensha 3y agoGoogle has the money to hire customer service representatives for customers to call when they have a problem, but they don't do so, because it's not a priority for them. It's the same with Microsoft and security.
- nvy 3y agoYes, and Google rightly gets criticized for it. Microsoft is getting the same treatment for being equally shitty.
- midoridensha 3y agoRight, and how is this helping? Yes, Google gets criticized for not having any customer service. So... what? Has this affected Google's profitability one iota? No. Same with MS.
- nvy 3y agoI don't understand your objective in this conversation. Are you trying to argue it's okay that Microsoft is incompetent, because Google also has bad customer service? Or that we shouldn't criticize Microsoft's awful security practices because it's "not their priority"?
- sublinear 3y ago> "the definition of insanity is doing the same thing and expecting a different result" This is a nitpick, but it's often completely reasonable to expect a different result by doing the same thing. Nothing against what you wrote, I just hate this saying so much. It's usually wrong to assume things are context-free. Most of life is defined by routine. Erosion carved out the surface of the earth, breathing and eating keeps you alive, etc. At some point the definition of "same" comes under scrutiny and you will find that it's impossible to truly do the exact same thing more than once, and yet even if it was possible you might still get a different result because other things you had no control over changed. Entropy makes it all just so.
- midoridensha 3y agoWell, I think the saying kinda implies that the conditions are the same. Obviously, common sense dictates that doing the same thing when conditions are radically different can yield different results. (For instance, taking a deep breath is usually good for you. But doing so underwater is obviously not.) Of course, this then leads to an argument over how the conditions differ in the example where the saying is used, like with MS here.
- benterix 3y agoWell, practically speaking the conditions are never the same in the course of action. If you are trying to break something, for example, at first you don't succeed but in the end, after repeating the same action again and again, you finally do.