4 ms·

> That describes Google’s experience. After the Operation Aurora attacks in 2009, Google went about designing and implementing a completely different, secure IT

> That describes Google’s experience. After the Operation Aurora attacks in 2009, Google went about designing and implementing a completely different, secure IT model that still powers the company today. > But what are the incentives guiding Microsoft toward, in the words of public relations weasels the world over, “taking your security very seriously”? Seven years before that, in 2002, Bill Gates, then CEO, sent an immediately famous email to all of Microsoft: https://www.wired.com/2002/01/bill-gates-trustworthy-computing/ https://www.wired.com/2002/01/bill-gates-trustworthy-computi... Over the last year it has become clear that ensuring .NET is a platform for Trustworthy Computing is more important than any other part of our work. If we don't do this, people simply won't be willing -- or able -- to take advantage of all the other great work we do. Trustworthy Computing is the highest priority for all the work we are doing. We must lead the industry to a whole new level of Trustworthiness in computing. It gets stronger and better from there. I don't love Microsoft, but the OP's history is wrong.

deleted 3y ago
[deleted]
Andrex 3y ago
I seem to remember Microsoft having a flash of security-focused mindset up to and shortly after Vista released (new driver model, Windows Defender, better Windows Updates, etc.) Then they stopped talking about it by 7 and by 8 it was all about the touch UI and "convergence." Some kind of rot kept spreading and now we have an extremely flaky Windows 11[0][1][2][3] and Russians infiltrating Microsoft for 5+ months (and may still even be in the system today![4]) using goddamn password-spraying. One CEO memo from 22 years ago doesn't make a strong case against the OP's argument, in fact a reading of later history enhances it. In comparison, Google has never gotten hacked on the scale they did with China, or Microsoft recently with Russia, since implementing zero-trust company-wide. If you know of any such incident since 2009, I'd be keen to learn them. 0. https://www.windowslatest.com/2024/03/16/windows-11-kb5035853-march-2024-update-causes-major-issues-bsods/ https://www.windowslatest.com/2024/03/16/windows-11-kb503585... 1. https://www.theregister.com/2024/01/12/microsoft_update_for_bitlocker_vuln/ https://www.theregister.com/2024/01/12/microsoft_update_for_... 2. https://www.windowslatest.com/2024/02/19/windows-february-2024-update-causes-taskbar-to-disappear/ https://www.windowslatest.com/2024/02/19/windows-february-20... 3. https://www.theverge.com/2023/8/24/23844054/microsoft-windows-11-bsod-kb5029351-msi-motherboard-bios-update https://www.theverge.com/2023/8/24/23844054/microsoft-window... 4. https://www.foxbusiness.com/technology/microsoft-warns-russian-hackers-using-execs-stolen-emails-broaden-cyberattacks https://www.foxbusiness.com/technology/microsoft-warns-russi...
- nradov 3y ago
  Well we have no way of knowing that they haven't been hacked. Foreign intelligence services have almost certainly tried to insert or recruit assets in all prominent tech companies. It's possible they succeeded with Google (or Microsoft) but haven't been detected yet.
- roenxi 3y ago
  In a democracy, the real problem is voters. In markets, the real problem is the customers. In this case, it seems to be both. I'm making a guess here that the real issue is that customers don't understand security and won't pay for it. They do understand that security is inconvenient and punish MS for implementing inconvenient features. That would explain the behaviour seen around the release of Vista - a company learning that security might be important to their CEO and dev team, but they will get financially punished for prioritising it so the bean counters step in and overrule that funny business on behalf of the customers. I'd go further and say that the correct thing to do here is to train government purchasing officers on security and punish them for buying insecure software. This "Microsoft has the market buttoned up due to a few key strengths" business in the article shows that too. If the government really understood its own needs, it could organise for someone else to build software that meets them. From their perspective Libreoffice and MS Office might be incomparable, but there is no argument that technically they are very similar. Business needs could be met too if someone put some budget into it for a few years and it isn't that hard. The issue here is entirely that government contracts won't move around based on real security concerns.
  - deleted 3y ago
    [deleted]
Jedd 3y ago
> Seven years before that, in 2002, Bill Gates ... And just four years before that, Bill was being recalcitrant in front of the US government, with utterances like: 'I don’t know what you mean “concerned.”' It's possible that the whole organisation had a resilient change of attitude in 2002, but as sibling comment by Andrex observes, there's no evidence to suggest this. For example - https://news.ycombinator.com/item?id=37702095 https://news.ycombinator.com/item?id=37702095 'Everything authenticated by Microsoft is tainted' from 2023-09
- wolverine876 3y ago
  > just four years before that, Bill was being recalcitrant in front of the US government I don't see what that has to do with security. Microsoft could be both monopolistic and security-focused.
  - Jedd 3y ago
    I'm suggesting that if Bill sends an internal-to-Microsoft email that says 'we're now 100% focused on security and will be forever', that this may not be a position statement we could 100% rely on to accurately describe the subsequent twenty+ years. Nor, obviously, should we assume that email represented a sincere, persistent, commitment to fundamental change of the way the company operates -- conversely, that there were no cynical elements of propaganda / marketing to that action.
_tk_ 3y ago
It has been obvious for some time now, that Microsoft uses security merely as a means to enhance profit. See all the security improvements that an organization gets, when upgrading from E3 to E5. Trustworthy computing has not been the guiding principle for Microsoft for years.
- nradov 3y ago
  Profit motive isn't a bad thing. If customers are willing to pay more for better security then of course Microsoft (and other vendors) will focus on that and make it a selling point.
  - _tk_ 3y ago
    I guess artists should charge extra for seats where the on-site EMTs can see you.
- imglorp 3y ago
  This. Look how long they let malware fester on desktop, even encouraged, without any built-in defense. Users rolled the dice to choose a sketchy third party solution and it turns out they were almost all dirty.
  - petre 3y ago
    > choose a sketchy third party solution and it turns out they were almost all dirty Yes, Kaspersky. Outsourcing your security to Russia.
  - wolverine876 3y ago
    > Look how long they let malware fester on desktop, even encouraged, without any built-in defense. Windows is loaded with defenses and security. You may debate it's affectiveness, efficiency, etc., but factually it's there.

deleted 3y ago

[deleted]

Andrex 3y ago

I seem to remember Microsoft having a flash of security-focused mindset up to and shortly after Vista released (new driver model, Windows Defender, better Windows Updates, etc.) Then they stopped talking about it by 7 and by 8 it was all about the touch UI and "convergence." Some kind of rot kept spreading and now we have an extremely flaky Windows 11[0][1][2][3] and Russians infiltrating Microsoft for 5+ months (and may still even be in the system today![4]) using goddamn password-spraying. One CEO memo from 22 years ago doesn't make a strong case against the OP's argument, in fact a reading of later history enhances it. In comparison, Google has never gotten hacked on the scale they did with China, or Microsoft recently with Russia, since implementing zero-trust company-wide. If you know of any such incident since 2009, I'd be keen to learn them. 0. https://www.windowslatest.com/2024/03/16/windows-11-kb5035853-march-2024-update-causes-major-issues-bsods/ https://www.windowslatest.com/2024/03/16/windows-11-kb503585... 1. https://www.theregister.com/2024/01/12/microsoft_update_for_bitlocker_vuln/ https://www.theregister.com/2024/01/12/microsoft_update_for_... 2. https://www.windowslatest.com/2024/02/19/windows-february-2024-update-causes-taskbar-to-disappear/ https://www.windowslatest.com/2024/02/19/windows-february-20... 3. https://www.theverge.com/2023/8/24/23844054/microsoft-windows-11-bsod-kb5029351-msi-motherboard-bios-update https://www.theverge.com/2023/8/24/23844054/microsoft-window... 4. https://www.foxbusiness.com/technology/microsoft-warns-russian-hackers-using-execs-stolen-emails-broaden-cyberattacks https://www.foxbusiness.com/technology/microsoft-warns-russi...

nradov 3y ago
Well we have no way of knowing that they haven't been hacked. Foreign intelligence services have almost certainly tried to insert or recruit assets in all prominent tech companies. It's possible they succeeded with Google (or Microsoft) but haven't been detected yet.
roenxi 3y ago
In a democracy, the real problem is voters. In markets, the real problem is the customers. In this case, it seems to be both. I'm making a guess here that the real issue is that customers don't understand security and won't pay for it. They do understand that security is inconvenient and punish MS for implementing inconvenient features. That would explain the behaviour seen around the release of Vista - a company learning that security might be important to their CEO and dev team, but they will get financially punished for prioritising it so the bean counters step in and overrule that funny business on behalf of the customers. I'd go further and say that the correct thing to do here is to train government purchasing officers on security and punish them for buying insecure software. This "Microsoft has the market buttoned up due to a few key strengths" business in the article shows that too. If the government really understood its own needs, it could organise for someone else to build software that meets them. From their perspective Libreoffice and MS Office might be incomparable, but there is no argument that technically they are very similar. Business needs could be met too if someone put some budget into it for a few years and it isn't that hard. The issue here is entirely that government contracts won't move around based on real security concerns.
- deleted 3y ago
  [deleted]

Jedd 3y ago

> Seven years before that, in 2002, Bill Gates ... And just four years before that, Bill was being recalcitrant in front of the US government, with utterances like: 'I don’t know what you mean “concerned.”' It's possible that the whole organisation had a resilient change of attitude in 2002, but as sibling comment by Andrex observes, there's no evidence to suggest this. For example - https://news.ycombinator.com/item?id=37702095 https://news.ycombinator.com/item?id=37702095 'Everything authenticated by Microsoft is tainted' from 2023-09

wolverine876 3y ago
> just four years before that, Bill was being recalcitrant in front of the US government I don't see what that has to do with security. Microsoft could be both monopolistic and security-focused.
- Jedd 3y ago
  I'm suggesting that if Bill sends an internal-to-Microsoft email that says 'we're now 100% focused on security and will be forever', that this may not be a position statement we could 100% rely on to accurately describe the subsequent twenty+ years. Nor, obviously, should we assume that email represented a sincere, persistent, commitment to fundamental change of the way the company operates -- conversely, that there were no cynical elements of propaganda / marketing to that action.

_tk_ 3y ago

It has been obvious for some time now, that Microsoft uses security merely as a means to enhance profit. See all the security improvements that an organization gets, when upgrading from E3 to E5. Trustworthy computing has not been the guiding principle for Microsoft for years.

nradov 3y ago
Profit motive isn't a bad thing. If customers are willing to pay more for better security then of course Microsoft (and other vendors) will focus on that and make it a selling point.
- _tk_ 3y ago
  I guess artists should charge extra for seats where the on-site EMTs can see you.
imglorp 3y ago
This. Look how long they let malware fester on desktop, even encouraged, without any built-in defense. Users rolled the dice to choose a sketchy third party solution and it turns out they were almost all dirty.
- petre 3y ago
  > choose a sketchy third party solution and it turns out they were almost all dirty Yes, Kaspersky. Outsourcing your security to Russia.
- wolverine876 3y ago
  > Look how long they let malware fester on desktop, even encouraged, without any built-in defense. Windows is loaded with defenses and security. You may debate it's affectiveness, efficiency, etc., but factually it's there.