9 ms·

On Microsoft, the U.S. Government Must Embrace the Stick

101 points by everybodyknows 3y ago

darby_eight 3y ago
> Good security happens when the incentives are right. Has this ever happened before? I can't name a single major company on earth that takes customer security seriously except through farcical characterization of the concept. It's just too much of an impediment to profitable business to be incentivized in any serious sense. Even the concept of "security" without parameterization of a threat model seems to make a joke of the concept. I'm not claiming that free software offers security that's better per threat model, but they at least allow customization of the threat model itself. Without this being up for discussion such a claim to discuss security in general is extremely difficult to take seriously. The Google threat model openly lauded in the article seemingly doesn't take state actors as a serious threat model, for instance. They'll just hand your data over to the state that asks for it because they want the business that happens under that state.
- deleted 3y ago
  [deleted]
- mupuff1234 3y ago
  > The Google threat model openly lauded in the article seemingly doesn't take state actors as a serious threat model The article specifically mentioned the Google threat model was a result of a state actor threat ("Operation Aurora").
  - darby_eight 3y ago
    Fair, but that's hardly the state I'm concerned about.
- kelnos 3y ago
  > They'll just hand your data over to the state that asks for it because they want the business that happens under that state. In addition to what the sibling poster pointed out about Aurora, even Google is starting to wise up about the undesirability of holding so much customer data (for Google, more from a government subpoena standpoint than from a security-from-hackers standpoint), with the recent changes to how their location tracking / Timeline feature works.
gwd 3y ago
> There are simply no viable alternatives to something like Excel, for a lot of organizations at least. Anyone want to educate me on this? Anything I want to do in a spreadsheet, I can do in Gnumeric, Libre Office, or even Numbers; anything more complicated I'd rather do in a proper programming language. What makes Excel really so indispensable?
- naasking 3y ago
  Poor vBA support in those alternatives, which is used more than you think.
  - tracker1 3y ago
    MS is seeing their own issues shifting to JS/TS to support the online versions better.
- RajT88 3y ago
  > What makes Excel really so indispensable? Not having to train all your accountants on something which is similar, but different enough they are less effective until they know it as well. The integration is another piece, as the article mentioned - the MS ecosystem makes making all documents cloud documents and sharable and collaborative within your enterprise a total snap. I'm not aware of actual core functional pieces of excel which matter to most users that you can't get elsewhere.
  - Ekaros 3y ago
    Also, that it has nearly everything anyone could need in single product. Maybe outside some very specialised analysts. So one tool works for most people. And then there is interoperability, everyone is using it and everyone accepts it as document format.
  - dataking 3y ago
    > the MS ecosystem makes making all documents cloud documents and sharable and collaborative within your enterprise a total snap. Same for Google Sheets, they're fairly interoperable with the MS formats too.
giancarlostoro 3y ago
Heck, we saw a Show HN of a direct excel competitor for much larger spreadsheets that churns through them like if its nothing, made by former Amazon S3 engineers: https://news.ycombinator.com/item?id=39551064 https://news.ycombinator.com/item?id=39551064
- donmcronald 3y ago
  The first thing I do for anything like that is click the pricing tab. Then I see subscription only options, close the tab, and never think about it again. Maybe I’ll go for it in 10 years once MS forces Excel to subscription only licenses and all the current perpetual options are EoL, but until then I’d rather own my data and tools.
  - lcvw 3y ago
    Isn’t excel subscription only now?
    - csande17 3y ago
      Nope, it's still available as a one-time purchase. https://www.microsoft.com/en-us/microsoft-365/p/office-home-business-2021/cfq7ttc0hpn4 https://www.microsoft.com/en-us/microsoft-365/p/office-home-... https://techcommunity.microsoft.com/t5/microsoft-365-blog/upcoming-preview-of-microsoft-office-ltsc-2024/ba-p/4082963 https://techcommunity.microsoft.com/t5/microsoft-365-blog/up...
      - giancarlostoro 3y ago
        Pretty sure last time I tried to install an old enough version of Office, it forced me to upgrade somehow. I couldn't stop it either, it was a toxic UI.
probably_satan 3y ago
[flagged]
- tw04 3y ago
  That’s some unsubstantiated full tinfoil hat conspiracy if I’ve ever seen it. Also you may want to review your history. It was Nixon who opened the door to China. Whether you think that was a good or bad decision, it was made long before Clinton had anything to do with it. https://en.m.wikipedia.org/wiki/1972_visit_by_Richard_Nixon_to_China https://en.m.wikipedia.org/wiki/1972_visit_by_Richard_Nixon_...
thunfisch 3y ago
Did I read this wrong, or is the article essentially "Microsoft screws up security over and over again. Let's throw humans in Russia that are exposing these vulnerabilities under the bus of a dictatorship and possibly get them killed in a war. Instead of forcing the gigantic cooperation to not screw up security over and over again and finally clean their house"? Wow.
- hyperpape 3y ago
  I agree with your top level point, but I find your phrasing absurd. The "humans who are exposing those vulnerabilities" are doing it to profit by committing extremely disruptive attacks on random businesses, hospitals, and important infrastructure. I don't support literally getting them killed, but they're not innocent hackers driven by curiosity the way your comment makes it sound.
- tw04 3y ago
  > Let's throw humans in Russia that are exposing these vulnerabilities under the bus of a dictatorship and possibly get them killed in a war. Am I reading this right that you’re more concerned with Russian assets that hack US companies for both financial gain and political leverage, than the US citizens whose lives are put at risk? What exactly do you think happens when a ransomware gang locks down a hospital?
  - thunfisch 3y ago
    I'm concerned with suggesting that it's enough to fight one group of adversaries, which will then be replaced with another group, and another, instead of actually fixing the underlying issue. Suggesting threat of life to those people (which is a very real thing for russians now) is no better than what happens when a ransomware gang locks down a hospital. That would be fighting fire with fire.
    - dralley 3y ago
      Por que no los dos.
  - 3y ago
wolverine876 3y ago
> That describes Google’s experience. After the Operation Aurora attacks in 2009, Google went about designing and implementing a completely different, secure IT model that still powers the company today. > But what are the incentives guiding Microsoft toward, in the words of public relations weasels the world over, “taking your security very seriously”? Seven years before that, in 2002, Bill Gates, then CEO, sent an immediately famous email to all of Microsoft: https://www.wired.com/2002/01/bill-gates-trustworthy-computing/ https://www.wired.com/2002/01/bill-gates-trustworthy-computi... Over the last year it has become clear that ensuring .NET is a platform for Trustworthy Computing is more important than any other part of our work. If we don't do this, people simply won't be willing -- or able -- to take advantage of all the other great work we do. Trustworthy Computing is the highest priority for all the work we are doing. We must lead the industry to a whole new level of Trustworthiness in computing. It gets stronger and better from there. I don't love Microsoft, but the OP's history is wrong.
- deleted 3y ago
  [deleted]
- Andrex 3y ago
  I seem to remember Microsoft having a flash of security-focused mindset up to and shortly after Vista released (new driver model, Windows Defender, better Windows Updates, etc.) Then they stopped talking about it by 7 and by 8 it was all about the touch UI and "convergence." Some kind of rot kept spreading and now we have an extremely flaky Windows 11[0][1][2][3] and Russians infiltrating Microsoft for 5+ months (and may still even be in the system today![4]) using goddamn password-spraying. One CEO memo from 22 years ago doesn't make a strong case against the OP's argument, in fact a reading of later history enhances it. In comparison, Google has never gotten hacked on the scale they did with China, or Microsoft recently with Russia, since implementing zero-trust company-wide. If you know of any such incident since 2009, I'd be keen to learn them. 0. https://www.windowslatest.com/2024/03/16/windows-11-kb5035853-march-2024-update-causes-major-issues-bsods/ https://www.windowslatest.com/2024/03/16/windows-11-kb503585... 1. https://www.theregister.com/2024/01/12/microsoft_update_for_bitlocker_vuln/ https://www.theregister.com/2024/01/12/microsoft_update_for_... 2. https://www.windowslatest.com/2024/02/19/windows-february-2024-update-causes-taskbar-to-disappear/ https://www.windowslatest.com/2024/02/19/windows-february-20... 3. https://www.theverge.com/2023/8/24/23844054/microsoft-windows-11-bsod-kb5029351-msi-motherboard-bios-update https://www.theverge.com/2023/8/24/23844054/microsoft-window... 4. https://www.foxbusiness.com/technology/microsoft-warns-russian-hackers-using-execs-stolen-emails-broaden-cyberattacks https://www.foxbusiness.com/technology/microsoft-warns-russi...
politelemon 3y ago
I find this author's opinions written in bad faith and outright ignorance — if it's deliberate ignorance, that's even worse. > there aren’t many incentives in this scenario for Microsoft to really improve the security This is wrong, the incentives already exist through financial and legal means, and anyone who works in an enterprise with their sprawling estate can tell you that they are constantly working on security controls and tooling. The key thing to remember is the sprawling estate, more surfaces means more attack vectors, and patches. I hope a cybersecurity professional isn't equating more mitigations with a poor security posture. It's when things are silent that you ought to be terrified. > The FBI and the U.K.’s National Crime Agency, for example, have done a tremendous job of gaining access to things like the Tor hidden services that underpin attacker infrastructure, collecting evidence from them, and then shutting them down. > when Western authorities started “disrupting” ransomware crews Conveniently ignores that a lot of them work directly with MS to take down botnets and ransomware threat actors. No mention whatsoever of MS' role in this. I struggled to take any of this seriously, especially when it came to the pretentious I-am-very-smarter-than-you attitude. > as I looked around the room I couldn’t help wonder if the way to really deal with this problem would be found in a different venue ... perhaps at a capture-the-flag hacking contest being held in a dimly lit casino ballroom in Las Vegas.
devwastaken 3y ago
Designing malware for windows is trivial. The NT kernel is designed to be unsafe. All you have to do is call certain win32 functions that will cause the kernel to call itself and you can do whatever you want. Even without this hilarious security hole windows has no concept of app permissions. Antivirus's are a joke, they can't tell what is goodware or malware. Anything that can gain user space privledges can compromise the whole system under windows. They disable file extensions by default and make it easy to use fake ones. "Hey look at this report - exereport.pdf" or a dozen other executable extensions. Adobe should be liable for PDF exploits as well. Start fining and fund a security org with it. This is all documented in even basic tutorials. Windows is still what they designed back in the 90's. It doesn't get scrutiny because it's all closed source and has big political ties.
- speuleralert 3y ago
  > All you have to do is call certain win32 functions that will cause the kernel to call itself and you can do whatever you want. Could you elaborate on what you mean by this?
  - devwastaken 3y ago
    https://youtu.be/-M2_mZg_2Ew https://youtu.be/-M2_mZg_2Ew Known as "indirect syscalls".
mproud 3y ago
Should be “its time has come”
_8j50 3y ago
They paywall critical security logs. That alone merits a governmental inquiry.

> Good security happens when the incentives are right. Has this ever happened before? I can't name a single major company on earth that takes customer security seriously except through farcical characterization of the concept. It's just too much of an impediment to profitable business to be incentivized in any serious sense. Even the concept of "security" without parameterization of a threat model seems to make a joke of the concept. I'm not claiming that free software offers security that's better per threat model, but they at least allow customization of the threat model itself. Without this being up for discussion such a claim to discuss security in general is extremely difficult to take seriously. The Google threat model openly lauded in the article seemingly doesn't take state actors as a serious threat model, for instance. They'll just hand your data over to the state that asks for it because they want the business that happens under that state.

deleted 3y ago
[deleted]
mupuff1234 3y ago
> The Google threat model openly lauded in the article seemingly doesn't take state actors as a serious threat model The article specifically mentioned the Google threat model was a result of a state actor threat ("Operation Aurora").
- darby_eight 3y ago
  Fair, but that's hardly the state I'm concerned about.
kelnos 3y ago
> They'll just hand your data over to the state that asks for it because they want the business that happens under that state. In addition to what the sibling poster pointed out about Aurora, even Google is starting to wise up about the undesirability of holding so much customer data (for Google, more from a government subpoena standpoint than from a security-from-hackers standpoint), with the recent changes to how their location tracking / Timeline feature works.

gwd 3y ago

> There are simply no viable alternatives to something like Excel, for a lot of organizations at least. Anyone want to educate me on this? Anything I want to do in a spreadsheet, I can do in Gnumeric, Libre Office, or even Numbers; anything more complicated I'd rather do in a proper programming language. What makes Excel really so indispensable?

naasking 3y ago
Poor vBA support in those alternatives, which is used more than you think.
- tracker1 3y ago
  MS is seeing their own issues shifting to JS/TS to support the online versions better.
RajT88 3y ago
> What makes Excel really so indispensable? Not having to train all your accountants on something which is similar, but different enough they are less effective until they know it as well. The integration is another piece, as the article mentioned - the MS ecosystem makes making all documents cloud documents and sharable and collaborative within your enterprise a total snap. I'm not aware of actual core functional pieces of excel which matter to most users that you can't get elsewhere.
- Ekaros 3y ago
  Also, that it has nearly everything anyone could need in single product. Maybe outside some very specialised analysts. So one tool works for most people. And then there is interoperability, everyone is using it and everyone accepts it as document format.
- dataking 3y ago
  > the MS ecosystem makes making all documents cloud documents and sharable and collaborative within your enterprise a total snap. Same for Google Sheets, they're fairly interoperable with the MS formats too.

giancarlostoro 3y ago

Heck, we saw a Show HN of a direct excel competitor for much larger spreadsheets that churns through them like if its nothing, made by former Amazon S3 engineers: https://news.ycombinator.com/item?id=39551064 https://news.ycombinator.com/item?id=39551064

donmcronald 3y ago
The first thing I do for anything like that is click the pricing tab. Then I see subscription only options, close the tab, and never think about it again. Maybe I’ll go for it in 10 years once MS forces Excel to subscription only licenses and all the current perpetual options are EoL, but until then I’d rather own my data and tools.
- lcvw 3y ago
  Isn’t excel subscription only now?
  - csande17 3y ago
    Nope, it's still available as a one-time purchase. https://www.microsoft.com/en-us/microsoft-365/p/office-home-business-2021/cfq7ttc0hpn4 https://www.microsoft.com/en-us/microsoft-365/p/office-home-... https://techcommunity.microsoft.com/t5/microsoft-365-blog/upcoming-preview-of-microsoft-office-ltsc-2024/ba-p/4082963 https://techcommunity.microsoft.com/t5/microsoft-365-blog/up...
    - giancarlostoro 3y ago
      Pretty sure last time I tried to install an old enough version of Office, it forced me to upgrade somehow. I couldn't stop it either, it was a toxic UI.

probably_satan 3y ago

[flagged]

tw04 3y ago
That’s some unsubstantiated full tinfoil hat conspiracy if I’ve ever seen it. Also you may want to review your history. It was Nixon who opened the door to China. Whether you think that was a good or bad decision, it was made long before Clinton had anything to do with it. https://en.m.wikipedia.org/wiki/1972_visit_by_Richard_Nixon_to_China https://en.m.wikipedia.org/wiki/1972_visit_by_Richard_Nixon_...

thunfisch 3y ago

Did I read this wrong, or is the article essentially "Microsoft screws up security over and over again. Let's throw humans in Russia that are exposing these vulnerabilities under the bus of a dictatorship and possibly get them killed in a war. Instead of forcing the gigantic cooperation to not screw up security over and over again and finally clean their house"? Wow.

hyperpape 3y ago
I agree with your top level point, but I find your phrasing absurd. The "humans who are exposing those vulnerabilities" are doing it to profit by committing extremely disruptive attacks on random businesses, hospitals, and important infrastructure. I don't support literally getting them killed, but they're not innocent hackers driven by curiosity the way your comment makes it sound.
tw04 3y ago
> Let's throw humans in Russia that are exposing these vulnerabilities under the bus of a dictatorship and possibly get them killed in a war. Am I reading this right that you’re more concerned with Russian assets that hack US companies for both financial gain and political leverage, than the US citizens whose lives are put at risk? What exactly do you think happens when a ransomware gang locks down a hospital?
- thunfisch 3y ago
  I'm concerned with suggesting that it's enough to fight one group of adversaries, which will then be replaced with another group, and another, instead of actually fixing the underlying issue. Suggesting threat of life to those people (which is a very real thing for russians now) is no better than what happens when a ransomware gang locks down a hospital. That would be fighting fire with fire.
  - dralley 3y ago
    Por que no los dos.
- 3y ago

wolverine876 3y ago

> That describes Google’s experience. After the Operation Aurora attacks in 2009, Google went about designing and implementing a completely different, secure IT model that still powers the company today. > But what are the incentives guiding Microsoft toward, in the words of public relations weasels the world over, “taking your security very seriously”? Seven years before that, in 2002, Bill Gates, then CEO, sent an immediately famous email to all of Microsoft: https://www.wired.com/2002/01/bill-gates-trustworthy-computing/ https://www.wired.com/2002/01/bill-gates-trustworthy-computi... Over the last year it has become clear that ensuring .NET is a platform for Trustworthy Computing is more important than any other part of our work. If we don't do this, people simply won't be willing -- or able -- to take advantage of all the other great work we do. Trustworthy Computing is the highest priority for all the work we are doing. We must lead the industry to a whole new level of Trustworthiness in computing. It gets stronger and better from there. I don't love Microsoft, but the OP's history is wrong.

deleted 3y ago
[deleted]
Andrex 3y ago
I seem to remember Microsoft having a flash of security-focused mindset up to and shortly after Vista released (new driver model, Windows Defender, better Windows Updates, etc.) Then they stopped talking about it by 7 and by 8 it was all about the touch UI and "convergence." Some kind of rot kept spreading and now we have an extremely flaky Windows 11[0][1][2][3] and Russians infiltrating Microsoft for 5+ months (and may still even be in the system today![4]) using goddamn password-spraying. One CEO memo from 22 years ago doesn't make a strong case against the OP's argument, in fact a reading of later history enhances it. In comparison, Google has never gotten hacked on the scale they did with China, or Microsoft recently with Russia, since implementing zero-trust company-wide. If you know of any such incident since 2009, I'd be keen to learn them. 0. https://www.windowslatest.com/2024/03/16/windows-11-kb5035853-march-2024-update-causes-major-issues-bsods/ https://www.windowslatest.com/2024/03/16/windows-11-kb503585... 1. https://www.theregister.com/2024/01/12/microsoft_update_for_bitlocker_vuln/ https://www.theregister.com/2024/01/12/microsoft_update_for_... 2. https://www.windowslatest.com/2024/02/19/windows-february-2024-update-causes-taskbar-to-disappear/ https://www.windowslatest.com/2024/02/19/windows-february-20... 3. https://www.theverge.com/2023/8/24/23844054/microsoft-windows-11-bsod-kb5029351-msi-motherboard-bios-update https://www.theverge.com/2023/8/24/23844054/microsoft-window... 4. https://www.foxbusiness.com/technology/microsoft-warns-russian-hackers-using-execs-stolen-emails-broaden-cyberattacks https://www.foxbusiness.com/technology/microsoft-warns-russi...

politelemon 3y ago

I find this author's opinions written in bad faith and outright ignorance — if it's deliberate ignorance, that's even worse. > there aren’t many incentives in this scenario for Microsoft to really improve the security This is wrong, the incentives already exist through financial and legal means, and anyone who works in an enterprise with their sprawling estate can tell you that they are constantly working on security controls and tooling. The key thing to remember is the sprawling estate, more surfaces means more attack vectors, and patches. I hope a cybersecurity professional isn't equating more mitigations with a poor security posture. It's when things are silent that you ought to be terrified. > The FBI and the U.K.’s National Crime Agency, for example, have done a tremendous job of gaining access to things like the Tor hidden services that underpin attacker infrastructure, collecting evidence from them, and then shutting them down. > when Western authorities started “disrupting” ransomware crews Conveniently ignores that a lot of them work directly with MS to take down botnets and ransomware threat actors. No mention whatsoever of MS' role in this. I struggled to take any of this seriously, especially when it came to the pretentious I-am-very-smarter-than-you attitude. > as I looked around the room I couldn’t help wonder if the way to really deal with this problem would be found in a different venue ... perhaps at a capture-the-flag hacking contest being held in a dimly lit casino ballroom in Las Vegas.

devwastaken 3y ago

Designing malware for windows is trivial. The NT kernel is designed to be unsafe. All you have to do is call certain win32 functions that will cause the kernel to call itself and you can do whatever you want. Even without this hilarious security hole windows has no concept of app permissions. Antivirus's are a joke, they can't tell what is goodware or malware. Anything that can gain user space privledges can compromise the whole system under windows. They disable file extensions by default and make it easy to use fake ones. "Hey look at this report - exereport.pdf" or a dozen other executable extensions. Adobe should be liable for PDF exploits as well. Start fining and fund a security org with it. This is all documented in even basic tutorials. Windows is still what they designed back in the 90's. It doesn't get scrutiny because it's all closed source and has big political ties.

speuleralert 3y ago
> All you have to do is call certain win32 functions that will cause the kernel to call itself and you can do whatever you want. Could you elaborate on what you mean by this?
- devwastaken 3y ago
  https://youtu.be/-M2_mZg_2Ew https://youtu.be/-M2_mZg_2Ew Known as "indirect syscalls".

mproud 3y ago

Should be “its time has come”

_8j50 3y ago

They paywall critical security logs. That alone merits a governmental inquiry.