4 ms·

Size is correlated with resources. Microsoft should have the resources to throw at this problem. Unfortunately the Microsoft approach to software engineering i

Size is correlated with resources. Microsoft should have the resources to throw at this problem. Unfortunately the Microsoft approach to software engineering is to set a bunch of monkeys loose on a room full of keyboards, rather than to spend their considerable resources vying for top talent. (Obviously they do have some good engineers, no offense if you're one of them, it's simply that from my sample size of 5, 80% were just warm bodies with email access.)

dreamcompiler 3y ago
Of course they have the resources. What they don't have is the incentives to do better. Just like every other big company that has a breach, they are not punished when they ignore basic security and they are not rewarded for paying attention to it. In fact they are punished by Wall Street for paying attention to it, because that costs money. As long as all they have to do is say "Whoops! We're sorry" when a breach happens, we should expect breaches to be the norm for all big companies.
- insanitybit 3y ago
  They definitely have the incentives. This conversation is a good example of that. Azure is attempting to compete in an aggressively competitive market and their customers absolutely care about security.
- bagacrap 3y ago
  Hopefully a news item as large as this one will cause them to lose some contracts, at least at the margin.
  - hulitu 3y ago
    You expect too much from Sales and CIOs/CEOs. Most of them have no idea what this is, but they make the decision to buy SW products.
- BLKNSLVR 3y ago
  > Of course they have the resources. What they don't have is the incentives to do better. Off-topic: this is exactly the same reason that Google offers up ads for scams and ads containing or linking to malware on their own advertising network. The only way to get to the size of these companies is to scale what can be scaled, and damn the rest until the pigeons come home to roost. Which, if they play their political-donation cards right, won't happen. And if it does, jeez they've made bank in the meantime, and will Goodhart the shit out of whatever watered-down legislational changes may make their way through.
lost_tourist 3y ago
Yep they could be hiring independent hackers to test their security 24/7 and they just simpley "don't" . It's like me doing a security audit of my own software, that would be just dumb, so you have pen test dudes who poke at it.
- bagacrap 3y ago
  In addition to that, security should probably be a consideration at the design phase of any feature or product. As in, an internal team should be vetting design and critical areas of the code itself. But the culture there only cares about "partner requirements". Security, tech debt, UX are simply glossed over.

dreamcompiler 3y ago

Of course they have the resources. What they don't have is the incentives to do better. Just like every other big company that has a breach, they are not punished when they ignore basic security and they are not rewarded for paying attention to it. In fact they are punished by Wall Street for paying attention to it, because that costs money. As long as all they have to do is say "Whoops! We're sorry" when a breach happens, we should expect breaches to be the norm for all big companies.

insanitybit 3y ago
They definitely have the incentives. This conversation is a good example of that. Azure is attempting to compete in an aggressively competitive market and their customers absolutely care about security.
bagacrap 3y ago
Hopefully a news item as large as this one will cause them to lose some contracts, at least at the margin.
- hulitu 3y ago
  You expect too much from Sales and CIOs/CEOs. Most of them have no idea what this is, but they make the decision to buy SW products.
BLKNSLVR 3y ago
> Of course they have the resources. What they don't have is the incentives to do better. Off-topic: this is exactly the same reason that Google offers up ads for scams and ads containing or linking to malware on their own advertising network. The only way to get to the size of these companies is to scale what can be scaled, and damn the rest until the pigeons come home to roost. Which, if they play their political-donation cards right, won't happen. And if it does, jeez they've made bank in the meantime, and will Goodhart the shit out of whatever watered-down legislational changes may make their way through.

lost_tourist 3y ago

Yep they could be hiring independent hackers to test their security 24/7 and they just simpley "don't" . It's like me doing a security audit of my own software, that would be just dumb, so you have pen test dudes who poke at it.

bagacrap 3y ago
In addition to that, security should probably be a consideration at the design phase of any feature or product. As in, an internal team should be vetting design and critical areas of the code itself. But the culture there only cares about "partner requirements". Security, tech debt, UX are simply glossed over.