3 ms·
How much worse does it have to get before someone holds Microsoft accountable for being criminally negligent? They have a 20+ year history of virtually non-exis
by Zelphyr 3y ago
How much worse does it have to get before someone holds Microsoft accountable for being criminally negligent? They have a 20+ year history of virtually non-existent concern for security.
- wannacboatmovie 3y agoAt least as criminally negligent as Apple, Google, and the Linux Foundation!
- ocdtrekkie 3y agoI would honestly say the past twenty years they did a really good job, and only done a particularly poor job in the past few years as they've prioritized cloud and ad revenue. Edge on Windows Server 2022 will happily load a bunch of MSN ad garbage now by default, after Microsoft had IE run in a restricted mode on servers for the previous twenty years.
- j16sdiz 3y agoI think microsoft have did a petty good job _patching_ vulnerabilities. Compare to SAP or Oracle regularly leaving exploits for years. If you do that incentive wrong, they might go full denial
- deleted 3y ago[deleted]
- fulafel 3y agoThe vulnerabilities don't pop into existence when some vulnerability researcher finally goes public about it and/or manages to convince MS to acknowledge+fix, but if you look at the vulnerability's actual existence timeline it's not that great a comfort. But yes they've been cajoled to improve their reactitivity. Their customers have very high tolerance of security flaws still, partly due to self-selection.
- i_love_cookies 3y ago[dead]
- pjmlp 3y agoStarting with Windows XP SP2, they have certainly a much better track record than many other companies. Now the whole industry could much better, and liabilities can't come soon enough for everyone.
- MaxBarraclough 3y agoI agree they've made some effort securing Windows. The same doesn't seem to be true for their cloud offerings though. A story from a few months ago: Microsoft Comes Under Blistering Criticism for 'Grossly Irresponsible' Security https://cacm.acm.org/news/275239-microsoft-comes-under-blistering-criticism-for-grossly-irresponsible-security/fulltext https://cacm.acm.org/news/275239-microsoft-comes-under-blist... HN discussion: https://news.ycombinator.com/item?id=36979532 https://news.ycombinator.com/item?id=36979532
- pjmlp 3y agoHere is one from Amazon, https://www.politico.eu/article/data-at-risk-amazon-security-threat/ https://www.politico.eu/article/data-at-risk-amazon-security...
- TheNewsIsHere 3y agoThis is much more about a widespread culture of spreading and accessing data within Amazon.com without much care for privacy, need to access, or auditing. Although I’m no AWS fanboy, that’s not an AWS problem. Which isn’t to say Azure doesn't have some failings. The recent signing key issue shows that even at the largest hyperscalers there are places where the basics are missing.
- deleted 3y ago[deleted]
- pelasaco 3y agoI don't think that's true, but watching the presentation, https://www.youtube.com/watch?v=IyPcXWIB990 https://www.youtube.com/watch?v=IyPcXWIB990 specially the last part, where the researcher explains why he wasn't paid by the bounty, sounds like they still have a lot to improve.
- jeroenhd 3y agoThe worst vulnerability, the RCE, was patched before Microsoft was even notified. The others are definitely bugs, but they do require valid credentials, which limit explotiability and therefore risk. These aren't nearly as bad as many of the CVEs that other vendors patch every week. It's hard to say what kind of files an authenticated user can read on fhr exchange server without the details on the vulnerabilities.