3 ms·
> The researchers notified Microsoft of the security lapse on February 6, and Microsoft secured the spilling files on March 5. That's pretty abysmal response t
by jorams 3y ago
> The researchers notified Microsoft of the security lapse on February 6, and Microsoft secured the spilling files on March 5.
That's pretty abysmal response time for what seems like it should be a simple fix for a serious problem.
- bsuvc 3y agoIt sounds like the credentials were embedded in code, so the fix probably involved all the steps of any production code change and deployment. I'm not defending it, because it is abysmal, just explaining probably why it took so long.
- k8svet 3y agoI want to be snarky, but even MS isn't that slow at deploying these days. Unless things have seriously regressed.
- bastawhiz 3y agoFaced with leaking internal data or having a broken system, you pretty much always choose the latter. You simply don't leave your front door open. Roll the secrets, break the system, and then fix the mess. The system was already broken from the moment credentials were leaked (or if you're a purist, from the moment they were hard coded into a file). The impact just wasn't realized or felt yet.
- bsuvc 3y agoAgreed, 100% I'm definitely not defending it, just saying the red tape in some orgs can be nearly impossible to defeat. This problem should have escalated as high as needed though to bypass the red tape and fix the security issue immediately. Probably a failure of weak middle management not having the guts to communicate the problem up.
- sunnybeetroot 3y agoSoftware isn’t black and white. You weigh the impact of both options.
- bastawhiz 3y agoIf there's a risk of exposing business secrets or user data, no, it's 100% black and white. It's weighing some downtime and/or annoyance against _unbounded risk_. It's unethical at best to choose uptime over revealing user data or the remote access to internal systems which you don't understand the complexity of.
- sunnybeetroot 3y agoI struggle to see when a business responsible for life support services in an industry like medical would choose to end lives over delaying the addressing of a data breach but maybe I’m not seeing the bigger picture?
- bastawhiz 3y ago1. Microsoft isn't in the business of life support systems. Turning off a system with exposed credentials isn't going to shut off all of Azure. Even if it did, are you really claiming that Azure downtime is life-and-death? 2. In what hypothetical universe does a life support system connected to the internet contain a trove of customer PII? And where disconnecting this hypothetical system from the internet _cause the patient it's supporting to die_?
- sunnybeetroot 3y agoI thought the discussion was extending beyond Microsoft and applying to any software. But if you are asking if it’s possible for Microsoft Azure to be the hosting provider for very important systems ie government, medical, then yes, these could impact a high degree of quality of life for people, even now or in the future.
- 3y ago