3 ms·

I seem to remember Microsoft having a flash of security-focused mindset up to and shortly after Vista released (new driver model, Windows Defender, better Windo

by Andrex 3y ago

I seem to remember Microsoft having a flash of security-focused mindset up to and shortly after Vista released (new driver model, Windows Defender, better Windows Updates, etc.) Then they stopped talking about it by 7 and by 8 it was all about the touch UI and "convergence." Some kind of rot kept spreading and now we have an extremely flaky Windows 11[0][1][2][3] and Russians infiltrating Microsoft for 5+ months (and may still even be in the system today![4]) using goddamn password-spraying. One CEO memo from 22 years ago doesn't make a strong case against the OP's argument, in fact a reading of later history enhances it. In comparison, Google has never gotten hacked on the scale they did with China, or Microsoft recently with Russia, since implementing zero-trust company-wide. If you know of any such incident since 2009, I'd be keen to learn them. 0. https://www.windowslatest.com/2024/03/16/windows-11-kb5035853-march-2024-update-causes-major-issues-bsods/ https://www.windowslatest.com/2024/03/16/windows-11-kb503585... 1. https://www.theregister.com/2024/01/12/microsoft_update_for_bitlocker_vuln/ https://www.theregister.com/2024/01/12/microsoft_update_for_... 2. https://www.windowslatest.com/2024/02/19/windows-february-2024-update-causes-taskbar-to-disappear/ https://www.windowslatest.com/2024/02/19/windows-february-20... 3. https://www.theverge.com/2023/8/24/23844054/microsoft-windows-11-bsod-kb5029351-msi-motherboard-bios-update https://www.theverge.com/2023/8/24/23844054/microsoft-window... 4. https://www.foxbusiness.com/technology/microsoft-warns-russian-hackers-using-execs-stolen-emails-broaden-cyberattacks https://www.foxbusiness.com/technology/microsoft-warns-russi...

nradov 3y ago
Well we have no way of knowing that they haven't been hacked. Foreign intelligence services have almost certainly tried to insert or recruit assets in all prominent tech companies. It's possible they succeeded with Google (or Microsoft) but haven't been detected yet.
roenxi 3y ago
In a democracy, the real problem is voters. In markets, the real problem is the customers. In this case, it seems to be both. I'm making a guess here that the real issue is that customers don't understand security and won't pay for it. They do understand that security is inconvenient and punish MS for implementing inconvenient features. That would explain the behaviour seen around the release of Vista - a company learning that security might be important to their CEO and dev team, but they will get financially punished for prioritising it so the bean counters step in and overrule that funny business on behalf of the customers. I'd go further and say that the correct thing to do here is to train government purchasing officers on security and punish them for buying insecure software. This "Microsoft has the market buttoned up due to a few key strengths" business in the article shows that too. If the government really understood its own needs, it could organise for someone else to build software that meets them. From their perspective Libreoffice and MS Office might be incomparable, but there is no argument that technically they are very similar. Business needs could be met too if someone put some budget into it for a few years and it isn't that hard. The issue here is entirely that government contracts won't move around based on real security concerns.
- deleted 3y ago
  [deleted]

by Andrex 3y ago

nradov 3y ago

Well we have no way of knowing that they haven't been hacked. Foreign intelligence services have almost certainly tried to insert or recruit assets in all prominent tech companies. It's possible they succeeded with Google (or Microsoft) but haven't been detected yet.

roenxi 3y ago

In a democracy, the real problem is voters. In markets, the real problem is the customers. In this case, it seems to be both. I'm making a guess here that the real issue is that customers don't understand security and won't pay for it. They do understand that security is inconvenient and punish MS for implementing inconvenient features. That would explain the behaviour seen around the release of Vista - a company learning that security might be important to their CEO and dev team, but they will get financially punished for prioritising it so the bean counters step in and overrule that funny business on behalf of the customers. I'd go further and say that the correct thing to do here is to train government purchasing officers on security and punish them for buying insecure software. This "Microsoft has the market buttoned up due to a few key strengths" business in the article shows that too. If the government really understood its own needs, it could organise for someone else to build software that meets them. From their perspective Libreoffice and MS Office might be incomparable, but there is no argument that technically they are very similar. Business needs could be met too if someone put some budget into it for a few years and it isn't that hard. The issue here is entirely that government contracts won't move around based on real security concerns.

deleted 3y ago
[deleted]