8 ms·

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I'

• formerly_proven 3y ago
  And just recently Sharepoint was found to accept alg: null JWT tokens (ie. complete authentication bypass)
  • ipython 3y ago
    Do you have a link to a cve or vuln report? I’d like to read more
    • formerly_proven 3y ago
      https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-chain/ https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-cha...
  • formerly_proven 3y ago
    You also have things like mimikatz - which is only a thing because Windows just stores user's passwords in plaintext in lsass memory -, pathetically weak hashes, pass the hash etc. Catastrophically-bad-by-design authentication is a Microsoft staple.
• chiefalchemist 3y ago
  > That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To Linux? The short answer is...yes. Of course it isn't easy. Of course it would take time. But it's certainly not impossible. It's certainly been done. I'm not defending MS but the idea that they're some sort of siren and companies can't help themeselves...well, please get me a list of those companies so we short the shocks if they're that incompetent.
  • Macha 3y ago
    Unfortunately even much of the open source world generates and distributes their official builds from Microsoft infrastructure. And even the distros themselves will get the source to do their own builds from the copies hosted on Microsoft infrastructure. So it's not a cure all if you suspect you can't trust GitHub.
  • the8472 3y ago
    It's not the first time that a company got compromised due to microsoft software. This time it was their cloud offering, the previous N times it was AD, Exchange, Outlook, WSUS (for delayed updates), ... And even if they'd move to something else they'd reach for solutions that also get their tentacles into everything because those solutions are convenient during those time windows where they're not exploited.
    • EGreg 3y ago
      Wasn’t SolarWinds Microsoft software being compromised too? When the US govt got hacked they actually did something about it government-wide. Started new security standards. For themselves and their vendors like M$
      • stonemetal12 3y ago
        SolarWinds is the name of company that was compromised, and as far as I can tell was never owned by MS.
        • 3y ago
• courseofaction 3y ago
  Another reason I am in love with LLMs. You don’t need to know the software like the back of your hand - a new environment is like a new programming language, as long as you’re able to ask the right questions new environments will be far more accessible. Experienced admins should know the requirements, and not be limited to the tools. Migrating will be relatively cheap. No wonder they’re hobbling the tools (/tinfoil), they see the threat.
  • dogleash 3y ago
    I'm not so convinced a LLM remixing all the tutorial blogs its ingested is a meaningful quality step above those tutorial blogs themselves. Earlier this year we had a linux task that was above the normal complexity my team deals with. So a few people threw it at chatgpt and were amazed at how good the results were. In reality, it was full of outright factual inaccuracies and non-breaking bad decisions. But their skill ceiling prevented them from seeing how bad the output was. I didn't want to be a wet blanket, so I let them have their fun and quietly guided the jr working on the resolution through an appropriate implementation.
    • jtbayly 3y ago
      You should point out to all of them now what the consequences would have been of blindly following the LLM. It's an important lesson they can and should learn from.
      • dogleash 3y ago
        Nah dog, I'm good. I'm not young, eager and naive anymore. "Growing the team's skills" and "working towards company goals" are siren calls. I know how to swim in my own lane.
  • hedora 3y ago
    My experience with LLMs is that they distill just the group think from the internet, and remove all rational thought. I doubt they'll be much help doing anything that is better than whatever standard practice was 6-12 months ago. If anything, I'd expect them to cement in incumbents and bad practices, since fewer people will be reading documentation and thinking critically about how to do better.
• TedDoesntTalk 3y ago
  > deserve what they get sadly This is incredibly insensitive and dismissive, and victim-blaming.
  • NoMoreNicksLeft 3y ago
    Someone complains of getting mugged, you say something about how they brought it on themselves... victim blaming. But if that someone hunts down the mugger, dances a jig in front of him, starts mocking, "oh come on, I have a thousand bucks cash on me, point the gun at me already"... well, telling them that they're doing it to themselves isn't victim blaming. It's objective truth, the only truth that matters. They're doing it right now. As we speak. We're having this conversation watching them while they try to throw themselves in front of the gun. It's time to stop worrying about whether or not we're insensitive when we describe what's happening in front of our eyes.
  • ladams 3y ago
    Is it? Every large company has a well compensated CTO whose job it is to think through these sorts of hypotheticals. But “nobody gets fired for choosing Microsoft”, and so the monopoly continues…
    • ajb 3y ago
      "A sound banker, alas, is not one who foresees danger and avoids it, but one who, when he is ruined, is ruined in a conventional and orthodox way along with his fellows, so that no one can really blame him"
      • H8crilA 3y ago
        The worst part is that very poor diversification / groupthink is exactly what creates financial bubbles and financial crises. We seem to be reaching that uncomfortable too-big-to-fail scale in computing / cyber security.
        • marcosdumay 3y ago
• EGreg 3y ago
  This is exactly the same attitude people got to Web3. So many scam tokens and rugpulls, they’re like “what are you gonna do? it’s the wild west.” Worse than that, when Celsius, FTX and other centralized companies imploded due to unsustainable and negligent practices many people were led to conflate that with Web3 blockchain smart contracts ecosystem. The ironic part is that Bitcoin and Ethereum, altcoins like Filecoin and the entire space of decentralized protocols (EVM, the coming-soon FVM, etc) was designed to eliminate centralized middlemen, including banking cartels, Amazon (which is being sued for monopolistic practices) and the soon-to-come CBDCs etc. In fact, all the responsible protocols (IPFS, UniSwap on Ethereum, Aave marketplace etc etc.) kept humming along regardless of bull and bear markets. It’s just distributed code! But middlemen were able to convince the public that their centralized companies “ARE web3” and then overpromised yields and other crap.And now the public conflates that with all decentralized protocols that carry value — that’s why we can’t have nice things. And a bunch of fly-by-night teams cloned contracts delivering no utility at all and some even put backdoors in them. Like PHP “give me the spaghetti codes” crowd and Javascript script kiddies and HTML personal sites with <blink> tags script kiddies… but with some money invested. Cryptographers were right to protest the word “crypto” being associated with this.
  • seabass-labrax 3y ago
    You are spot on with this; you don't need distributed systems and cryptography to run a fraudulent bank! Indeed, much of the 'trust' that comes with traditional financial institutions comes not from an inherent advantage in competence compared to cryptocurrency developers, but the fact that most national governments will bail out bank failures and reimburse vast sums of their citizens' losses. If cryptocurrency-based financial instruments were regulated and protected to the same degree as traditional companies - but with the relevent technical competence to match! - I'm sure 'pay with ETH' and the like would be as common as PayPal and VISA.
• appleskeptic 3y ago
  [flagged]
• Pat_Murph 3y ago
  Blatent case of Microsoft derangement syndrome. Hard to take your comments seriously with such obvious disdain against the company and ridiculous victim blaming.
  • lacrimacida 3y ago
    Can you instead adress the Op’s concerns rather than calling names?
• Spivak 3y ago
  > own ways to do anything but be a slave to Microsoft I guarantee 99/100 humans on this forum either currently host with AWS/GCP/Azure or have worked at a shop that does. And I bet an outsized portion of those AWS/GCP shops also host on Azure for Azure AD. There is no one that is ready for a de-Microsofted world. Even Linux distros have been increasing their support for integrating into the MS ecosystem and forsaking alternatives because how prevalent AD is. Even the most prominent alternative FreeIPA is designed to compliment an AD installation, not replace it. The best supported directory/central login server on Linux is AD.
  • lokar 3y ago
    My entire adult life and career has been MS free. It’s not that rare.
    • argiopetech 3y ago
      It's not that rare for developers and sys admins. It's pretty rare outside of that, particularly if you're on a corporate-managed system. Wander down to HR or finance or legal and see how many *nix systems you see.
      • lokar 3y ago
        I think ours have macs
    • daxelrod 3y ago
      MS is still probably somewhere in the supply chain of software you use. They have contributed to the Linux Kernel, they own GitHub and NPM, they make an extremely popular editor, among other things. It’s a different set of risks than depending on them directly, but they’re still there.
      • yjftsjthsd-h 3y ago
        Contributing to something and owning it are wildly different levels of control. The rest of it is reasonable, but Linux doesn't belong in your list.
• bob1029 3y ago
  > be a slave to Microsoft Ok. So are you suggesting that the most practicable alternative is to be a slave to [list of 100+ other vendors]? Going out of your way to defenestrate a trillion dollar technology vendor is a bit bananas to me. If you are trying to run a business, I think you are completely fucking yourself over with this sort of attitude. How much business convenience are you willing to squander over these principles? And, are you truly upholding your principles on a consistent basis or is this a reductive "at least it's not Microsoft" line of thinking? Microsoft is a big place. Some parts good some parts bad. You may be leaving a lot of upside on the table by never considering them as an option. We are a "Microsoft shop", but we still use other vendors when it makes sense. I don't trip over myself trying to get 100% off AWS over some ridiculous tribalism. Their domain registration and S3 object stores work really well for us so we continue to use them, even when it creates a bit of integration overhead (SCIM identity sync w/ AAD, etc).
  • crabbone 3y ago
    This would sound like ChatGPT if I didn't know better... All of your arguments are "made up" arguments, they contradict themselves or each other or assume some very unlikely situations, especially on behalf of what the post you replied to wanted to say, where it's clear it's not what it wanted to say. Let's dive in! > So are you suggesting that the most practicable alternative is to be a slave Clearly, the post you replied to doesn't suggest that. (But you went on arguing as if it did). > a trillion dollar technology vendor is a bit bananas to me. Nobody's killing Microsoft. But even if they were, maybe that's the right thing? You make no arguments not to. > If you are trying to run a business, I think you are completely fucking yourself over with this sort of attitude. The company I work for runs on Linux. The company I worked for before this runs on Linux. The company I worked for before the last one also runs on Linux. And the one before those two -- yes, you guessed it, also runs on Linux. The operating system chosen to run a business was never a serious factor in terms of whether the company succeeded or failed. By and large, it's not important. Are there specific technologies / products only available on Windows? -- You bet! What should be done about those? -- find a way asap to not make them exclusive to that platform. One of the most tragic situations in this respect is in medicine. Windows is ubiquitous in this field. To the point that I'd say that governments should step in and invest into the healthcare they control to change the situation. I.e. to do the complete opposite of what you are suggesting. > Microsoft is a big place. All under the same roof, with the same objectives and strategy, which are to screw you (the "Microsoft shop") in particular, but also, if possible even those who managed to stay away from them. The problems Microsoft creates for the world aren't somehow local to one or two departments of the company. The company, no matter how big is responsible for its policies.
• madsbuch 3y ago
  If it is the case that it is going to be extremely risky to run of MS supplied infrastructure (including Windows) we should see insurance premiums sky-rocket for companies and organisations using those platforms. Eventually, it will become cheaper to migrate off the MS platforms. This is mixed with an ever increasing legislative push and higher fines for leaking PII.
  • eqvinox 3y ago
    This already seems to be happening overall, though I can't quite find vendor specific data. e.g.: https://www.cnbc.com/2022/10/11/companies-are-finding-it-harder-to-get-cyber-insurance-.html https://www.cnbc.com/2022/10/11/companies-are-finding-it-har...
• hedora 3y ago
  Moving off Windows or Azure or whatever probably isn't adequate. All architectures based on certificate authorities are fundamentally fragile in the same way. People look at me like my head is spinning when I suggest just adding ephemeral self-signed CA root certs to deployment pipelines (or, god forbid, use SSH keys, or even symmetric keys). However, those approaches have a much, much smaller attack surface than HTTPS or standard X.509 SSH authentication, so I'll keep recommending it. I think the reason for the pushback is that, in this space, attack surface is roughly proportional to monetization potential.
  • jameshart 3y ago
    I’m not sure exactly what role in what sort of deployment pipeline you’re suggesting for ephemeral root certs here, and you may well have a solid handle on how to do this safely. But one reason I might initially look at you with alarm if you suggest self-signing or symmetric keys as part of a solution in general is… while it might reduce the attack surface, attack surface is not the only thing to worry about. Another thing to consider is the ‘fuckup surface’ of a particular architecture. And one problem that self managed key distribution strategies tend to run into is that they massively increase your fuckup surface. Losing the keys to everything can become a real danger. I’m a big believer in building security systems that also reduce the blast radius of dumb errors (accidentally running rm -rf /* is harmless if you religiously run with least privilege). Saying ‘I’m going to build my own trust root’ generally seems to me like it probably increases the blast radius.
• raintrees 3y ago
  For my smaller clients, I have been migrating them to Synology Directory Services (LDAP/DNS/SAMBA)... I import AD, switch the DNS on the workstations, good to go. Test it out, if curious - Pretty straight-forward. And a heck of a lot more economical.
• deleted 3y ago
  [deleted]
• temac 3y ago
  The concept of Microsoft-y admins supposedly unable to work with other tools is insane. There is not much in common between let's say Windows and MS365. Even within MS365 the integration between various tools is often not seemless and when you start using powershell admin common there are completely random differences between the way you login, plus where some features are implemented is also completely random (e.g. tons of non email things in exchange, at least accessed through the exchange ps connector) If an admin is able to navigate in all that shit, I don't know why they would not understand e.g. random unix tools.
• johnchristopher 3y ago
  > Certainly not, Microsoft-y admin only know Microsoft, they usually can't do much else, it's all they know. I am a linux sysadmin. Honest question: Would I have an edge on a Microsoft-y admin or are linux sysadmin skillset limited to Linux ? I can find my way around a lot of network appliances (sophos, cisco, junyper, etc.) and I'd expect a windows system to be as capable.