8 ms·
I'm not a fan of Microsoft, but this is some amazing blame shifting. The root cause of the problem is the government single-sourcing a vendor and being incapabl
by vlovich123 3y ago
I'm not a fan of Microsoft, but this is some amazing blame shifting. The root cause of the problem is the government single-sourcing a vendor and being incapable of negotiating with said vendor. The US government is 10% of Microsoft's annual revenue just on security services (if I read the article correctly) but is failing to negotiate. The right answer here is if the situation is that bad, make a very public long-term commitment to shift to something else & up-level your IT department to be able to execute multi-year projects competently. Instead of meeting Microsoft on the business playing field, it's trying to use scary "national security threat" verbiage to try to bully them in the court of public opinion.
Regarding security, at the end of the day, the US government is a huge target for adversaries. You can't outsource your security practices & if MS software is really that much worse they should be fixing their purchasing requirements. The reality though is that whatever software the US government would switch to would become the focus of adversarial research.
- theturtletalks 3y agoThe Pentagon can’t even pass an audit for the past 6 years, but yeah Microsoft is the national security threat.
- skhunted 3y agoWhat does one have to do with the other? It’s possible to have more than one threat.
- prepend 3y agoSecurity is frequently only as strong as the weakest link. If you’re an adversary, would you spend more time on an org’a poor security practices (pentagon failing audits) or a more difficult software vendor?
- Brybry 3y agoThat's not just a 6 years thing. The Pentagon has never passed an audit (the first Defense Department audit in its history was in 2017).
- vkou 3y agoWhat do you think 'can't pass an audit' means in the context of the DoD?
- theturtletalks 3y agoAt best, incompetence. At worst, corruption.
- vkou 3y agoIf so, you don't seem to understand why the DoD is failing to pass one, but are very well versed in the outrage you're supposed to feel when it does.
- theturtletalks 3y agoCare to enlighten me?
- vkou 3y agoIt's an enormous organization (one of the largest in the world) that is largely getting audited on physical objects that either spend 99% of their life sitting in stockpiles, or getting actively used and discarded. Passing an audit isn't having its checkbook balanced. Passing an audit is like your employer delivering a full and accurate account of how many chairs it owns, as well as providing all the necessary paper trail for how all of them were acquired, moved, and discarded. Doable in a 5-person company, or a 50-person company, next to impossible in a 5,000-person company, actually impossible in a 500,000 person company. And the DoD has hundreds of thousands of different types of such items to keep track of, all of which were tracked by disparate physical-fingers-counting-stuff accounting systems, that were historically not up to the expected standards. Updating them and reconciling all of them is a long process, which the DoD is working through. I hate war departments as much as the next liberal, but I also recognize that this is an incredibly difficult ask. And that the failures are generally not caused by Lt. Billy Bob filching Stinger missiles to sell to some warlord in East Oblastan. The grift in the DoD comes from contracts for buying more crap that it doesn't need, or for paying good money for contract work that doesn't get done (Iraq, Afghanistan), not from having stuff that was bought 'fall off the back of the truck'. The organization "has* an audit problem, but it's main issue is one of procurement.
- conover 3y agoThe Marine Corp actually just became the first military branch to pass an audit: https://www.military.com/daily-news/2024/02/24/marine-corps-becomes-first-military-branch-pass-financial-audit.html https://www.military.com/daily-news/2024/02/24/marine-corps-...
- wepple 3y agoI’d imagine that these proclamations are part of the negotiation. I wouldn’t want to be a Microsoft account executive on the US govt contract right now; they’re about to have a massive load of additional requirements. And if they don’t play ball, possibly antitrust to weaken their stranglehold on being the only real enterprise player. I’m not saying any of this is the right approach, but it’s a tool in the governments toolbox.
- mistrial9 3y agoany commercial channel filled with this much money will attract hordes of smiling useful idiots filling every possible niche. Now you have another problem, managing useful idiots over time. source: knows some idiots
- giantg2 3y ago"& up-level your IT department to be able to execute multi-year projects competently." Cheaper just to pay up.
- hn_version_0023 3y agoIME, paying up is HOW you level up.
- giantg2 3y agoThe pay isn't great, but there are other structural issues when dealing with the federal government.
- tiffanyh 3y ago> The US government is 10% of Microsoft's annual revenue just on security services How are you able to conclude that?
- kbenson 3y agoI assume it's the $20 billion in security services statement compared against their ~$200 billion yearly revenue. I'm not sure those security services are all for the U.S. govt though.
- InSteady 3y agoMy assumption is that the revenue figure is not exclusively the US government spending. Otherwise what percentage of their yearly revenue is security services to all the other countries as well as businesses in the world? The US government is of course a large customer, but a considerable part of the world runs on windows and other Microsoft products.
- qaq 3y agoWell you can't not outsource your security because gov payscale limits do not match market reality. You have to realise that a ton of people who should be directly employed by NSA etc. are actually working for their contracts for this reason.
- nobodyandproud 3y agoPartly this is due to the concentration of wealth, inaccessible to taxing. Naturally government pay would lag behind even the more mediocre H1Bs.
- acdha 3y ago> Partly this is due to the concentration of wealth, inaccessible to taxing. This has nothing to do with it. Contractors cost notably more, so if the goal was economizing it’d be an obvious step to cut out the middlemen by hiring staff directly. The problem is that there’s an entire political ideology holding that government is inherently wasteful and its adherents will oppose any attempt to track market salaries because that allows them both to say they’re saving money at the time and later to cite the struggling/failed project as proof that they were right.
- ProjectArcturis 3y agoYup. When a VC-backed company goes bankrupt, no one bats an eye. When Solyndra's loans go bad, even though it was a tiny fraction of the government's green energy portfolio, you get headlines and congressional hearings.
- mschuster91 3y ago> The right answer here is if the situation is that bad, make a very public long-term commitment to shift to something else & up-level your IT department to be able to execute multi-year projects competently. The problem is that there isn't much in terms of alternatives, especially not if you prefer to have one software / vendor / tech stack. - In groupware, there used to be Lotus Notes, but that went down the drain years ago. Thunderbird can do everything Outlook can (i.e. provide an email client, calendar and address book), but there is no official(ly supported) Thunderbird server software suite so there's always a potential for subtle bugs between whatever one chooses for directory, email and calendar backends. - for AD there's obviously Samba but it, again, lacks a management UI that supports all of its features, so yet another potential for issues. - the Office suite alternatives are even more of a nightmare, both in terms of usability, stability as well as compatibility with the millions of legacy files originating from Office. Or hell, even compatibility with old versions of the same app isn't a given in LibreOffice. (And I'm not sure stuff like MS Access even has a FOSS counterpart) - And then, there's all the other stuff that integrates with AD for authentication/authorization. In a lot of cases, it's "either use MS AD or you're on your own when you hit issues". - finally, Windows itself. Essentially, the US Government would have to sink billions of dollars into ReactOS development to make it compatible enough with mainstream Windows versions to run all the legacy software that people use - and no, WINE alone is not enough, not for anything that deals with hardware directly. And I wouldn't assume it's possible to even hire enough developers that are skilled to develop for WINE/ReactOS and fulfill the project requirements of never having been exposed to Windows source code. Microsoft has achieved an insane amount of vendor lock-in, even Apple with all its financial and technological might or Valve (who invested a huge amount of money and work into getting WINE feature-rich enough to run a ton of AAA games on their Steam Deck) have been able to even come close. They can provide as shitty a service/software as they want, their audience literally has no other choice. (Me personally, I'll keep my Windows 7 and 10 VMs alive for as long as I can, but no way in hell I'm ever moving to the ad-ridden, bling-bling flashy pseudo-hipster-UI disaster that is Windows 11)
- jonathanlydall 3y agoIf you want to use Windows outside of an air gapped environment, it’s reckless to use anything less than Windows 10, and even for that you have only about a year left unless you pay for extended support. Also, as someone who actually uses Windows 11 Professional all day, every working day, I honestly haven’t encountered these adverts everyone is always referring to (maybe it’s because I’m not in the US). As for the UI, initial release didn’t allow ungrouping of Windows on taskbar and context menus hid most things behind an extra click. This was crap, but a major update a while back has resolved these. I’ve tried Linux, I occasionally need to use it or macOS for development of our cross platform Electron based product, and I would still choose Windows as it really has consistently “just worked” for me since around Windows 2000. But if macOS or Linux works well for you, I’m happy you’re happy and perhaps you in turn could be happy for people who are happy with Windows (and ideally without thinking they must be deluded or something).
- szundi 3y agoNegotiate? They even can regulate.
- a_simple_man 3y agowe have a company that has a monopoly that is honestly unimaginable (how does someone monopolize computation of all things...) and we know that all monopolies require government enforcement to prevent others from competing... then we know that there's no such thing as a conflict between Microsoft and the us government the us govt is to serve Microsoft and that's that. any conversation like this about the merits of Microsoft as a market participant are laughable and disingenuous theres no programmer alive that knows the history of Microsoft that would speak about them as you have just done, as an honest company trying to make a product actually sick to see how HN has been corrupted
- extrememacaroni 3y agoit's ok, they said they're "not a fan of microsoft", clearly that means they're not corrupted.
- nonrandomstring 3y ago[dead]
- vlovich123 3y agoThen go after them for monopolistic abuses. Arguably Lina Khan is the first FTC chair to be making noise about it yet the only thing about Microsoft has been their OpenAI partnership because it's sexy & nothing about their traditional marketplace participation. The EU is going after them a bit more aggressively & having some success. Ultimately this would still be the US government's failings - claiming that makes Microsoft a national security threat is a joke & disingenous. I know the history of MS anti-trust fairly well having grown up during the core part of their monopolist years - now they're part of the familiar oligopaly that's strangling tech. > and we know that all monopolies require government enforcement to prevent others from competing... Do we know that? That may be true of government run monopologies, but I'm pretty sure most marketplace monopolies rely on lack of government enforcement. For example, here's some analysis showing how US case law makes the government wary of going after Amazon for driving Quidsi out of business & forcing an acquisition by Amazon: https://cei.org/blog/amazons-private-labels-dont-threaten-competition/ https://cei.org/blog/amazons-private-labels-dont-threaten-co.... Ironically US does enforce rules against dumping from international players which shows that it realizes the harm that such activity can have, it just chooses to allow it for domestic players abusing smaller domestic players.
- croes 3y agoYour post is some sort of victim blaming, how would multiple vendors or a better price improve security? Could be the opposite. Every provider is an attack vector of the government's network. The problem is MS fucked up big time by not only losing a key but also that this key is a master key due to an error. Not to mention they downplayed the problem afterwards and tried to charge customers for the logs needed to identify the attack.