3 ms·

Anything used will become a target. How the hell is MS a bigger threat than the rest? If anything a lot of the industry is a way bigger threat and spends less o

Anything used will become a target. How the hell is MS a bigger threat than the rest? If anything a lot of the industry is a way bigger threat and spends less on security.

wumeow 3y ago
I don’t understand your comment. Microsofts failures are a threat precisely because it is so used, especially by the US govt. And they may spend a lot on security, but their recent failures have been pretty amateurish. A recent breach they had was due to an old, non-2fa service account with a weak password and privileged access. See also the CISA report about last years breach.
- Avamander 3y ago
  And if it were ten open-source projects then they'd have to defend themselves against nation-state attackers. They're not ready for it. The researchers that demonstrated an attack on Linux got vilified instead of the maintainers that had misplaced their trust. *Researchers* not a truly sophisticated and a well-funded threat actor. Do you see the issue? Do you really think the alternatives are more diligent with their defense, 2FA, have spent as much time and effort on security? I truly don't like Microsoft but this seems like shitting on them but I really don't see the point. Anything they use is going to be a "national security threat." I'd gladly see other vendors stepping up, but it's enormously difficult and we're not really there yet.
  - wumeow 3y ago
    > And if it were ten open-source projects […] The alternative wouldn’t be to use a smattering of open-source stuff, it would be to go with a different cloud provider like AWS or Google. > Do you really think the alternatives are more diligent […] That’s what the CISA report suggested. I’m not shitting on MS, I just don’t want foreign adversaries to be able to pick apart our IT systems like vultures.
    - MSM 3y ago
      But AWS alternatives ARE just a smattering of open source stuff. Getting everything into AWS doesn't solve anything by itself, either. Then they'd still need to get everything off of windows, office, exchange, AD, etc. etc. Which is a ridiculous amount of work and they'd be fighting bugs and issues for years and years at their scale.
- deleted 3y ago
  [deleted]
- ripjaygn 3y ago
  > but their recent failures have been pretty amateurish > See also the CISA report about last years breach The same CISA who just recently got hacked in an even more amateurish way? https://news.ycombinator.com/item?id=40107675 https://news.ycombinator.com/item?id=40107675 https://securityintelligence.com/news/cisa-hackers-key-systems-offline/ https://securityintelligence.com/news/cisa-hackers-key-syste...
  - wumeow 3y ago
    Knowing and doing are separate skills.

Anything used will become a target. How the hell is MS a bigger threat than the rest? If anything a lot of the industry is a way bigger threat and spends less on security.

wumeow 3y ago

I don’t understand your comment. Microsofts failures are a threat precisely because it is so used, especially by the US govt. And they may spend a lot on security, but their recent failures have been pretty amateurish. A recent breach they had was due to an old, non-2fa service account with a weak password and privileged access. See also the CISA report about last years breach.

Avamander 3y ago
And if it were ten open-source projects then they'd have to defend themselves against nation-state attackers. They're not ready for it. The researchers that demonstrated an attack on Linux got vilified instead of the maintainers that had misplaced their trust. *Researchers* not a truly sophisticated and a well-funded threat actor. Do you see the issue? Do you really think the alternatives are more diligent with their defense, 2FA, have spent as much time and effort on security? I truly don't like Microsoft but this seems like shitting on them but I really don't see the point. Anything they use is going to be a "national security threat." I'd gladly see other vendors stepping up, but it's enormously difficult and we're not really there yet.
- wumeow 3y ago
  > And if it were ten open-source projects […] The alternative wouldn’t be to use a smattering of open-source stuff, it would be to go with a different cloud provider like AWS or Google. > Do you really think the alternatives are more diligent […] That’s what the CISA report suggested. I’m not shitting on MS, I just don’t want foreign adversaries to be able to pick apart our IT systems like vultures.
  - MSM 3y ago
    But AWS alternatives ARE just a smattering of open source stuff. Getting everything into AWS doesn't solve anything by itself, either. Then they'd still need to get everything off of windows, office, exchange, AD, etc. etc. Which is a ridiculous amount of work and they'd be fighting bugs and issues for years and years at their scale.
deleted 3y ago
[deleted]
ripjaygn 3y ago
> but their recent failures have been pretty amateurish > See also the CISA report about last years breach The same CISA who just recently got hacked in an even more amateurish way? https://news.ycombinator.com/item?id=40107675 https://news.ycombinator.com/item?id=40107675 https://securityintelligence.com/news/cisa-hackers-key-systems-offline/ https://securityintelligence.com/news/cisa-hackers-key-syste...
- wumeow 3y ago
  Knowing and doing are separate skills.