5 ms·

IMHO, this article isn't very substantive and reads like FUD for clicks. I'm inclined to believe that Microsoft is doing fairly well amongst Fortune 500 and cl

IMHO, this article isn't very substantive and reads like FUD for clicks. I'm inclined to believe that Microsoft is doing fairly well amongst Fortune 500 and cloud companies. Not perfect, but fairly well. Am I offbase? Edit: I guess I am. Thanks for clarifying and augmenting with more evidence, repliers.

bayindirh 3y ago
I think yes, you’re off base. Microsoft got their MSA secret stolen, allowing China to read government emails. Do you need another example? https://www.theregister.com/AMP/2023/09/06/microsoft_stolen_key_analysis/ https://www.theregister.com/AMP/2023/09/06/microsoft_stolen_...
- twisteriffic 3y ago
  Also Microsoft still does not know how that secret was stolen and has knowingly mislead customers and the media about that fact. https://www.dhs.gov/news/2024/04/02/cyber-safety-review-board-releases-report-microsoft-online-exchange-incident-summer https://www.dhs.gov/news/2024/04/02/cyber-safety-review-boar...
  - deleted 3y ago
    [deleted]
- HillRat 3y ago
  Specifically, a vintage 2016, unrevokable consumer signing key that was inadvertently allowed to sign identity tokens for enterprise substrates, which is a whole security house of cards.
ralph84 3y ago
Agreed. Almost all of the quotes are from Microsoft competitors shilling their wares.
wcchandler 3y ago
Yes, you are offbase. This is a fairly well written article that highlights and summarizes a few of their most recent gaffs. We recently re-evaluated our EDR solution and Microsoft was in the final 3. We didn't move them past the RFI process because of these recent incidents, on top of a very poorly packaged product (Defender). Microsoft has been really pushing the notion they're a security company (and my 401k would love it if that were true), but the sad reality is they continue to fall short in every possible way. I'll likely share this article with my peers when challenged on why we didn't move forward with them in our EDR project.
- gjsman-1000 3y ago
  Microsoft Defender was, and is, an inexcusably poorly thought through product. Just the branding - the name and logo is exactly the same as Windows Defender. It even puts an icon in the taskbar tray, resulting in two identical logos for two identically named products that do completely different things. No idea what they were thinking there. It seems they thought that the separation in consumers’ minds between “Microsoft” and “Windows” was strong, which it absolutely is not.
  - panzi 3y ago
    When I google for Windows Defender I only get hits for Microsoft Defender. What is it? I don't use Windows anymore.
    - gjsman-1000 3y ago
      Microsoft Defender for Individuals: https://www.microsoft.com/en-us/microsoft-365/blog/2022/06/16/introducing-microsoft-defender-a-new-microsoft-365-online-security-app-for-you-and-your-family/ https://www.microsoft.com/en-us/microsoft-365/blog/2022/06/1... Windows Defender aka Windows Security: https://support.microsoft.com/en-us/windows/stay-protected-with-windows-security-2ae0363d-0ada-c064-8b56-6a39afb6a963 https://support.microsoft.com/en-us/windows/stay-protected-w... Microsoft Defender XDR (completely different thing, previously known as Microsoft Defender for 365): https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-xdr https://www.microsoft.com/en-us/security/business/siem-and-x... Microsoft Defender for Endpoint (also a different thing, basically XDR lite): https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-endpoint https://www.microsoft.com/en-us/security/business/endpoint-s...
resource_waste 3y ago
I am unsure if ancient tech companies doing well is an indicator of quality. Sales teams and various vendor lockouts/ins can cause people to bend the knee. I accidentally pay $70/mo to microsoft because I bought wrong licenses that I needed only to serve a customer. Up until I started this company, I was 0% Microsoft.
Arnt 3y ago
You're right and wrong. I know about a team that does well and one that I think is begging for a major CVE. Microsoft is said to be a collection of almost independent companies sharing a domain and a CEO. Based on my experience, small as it is, I can believe it.
- patmorgan23 3y ago
  It's a flotilla of product ships sailing in the same general direction (hopefully)
  - nmcveity 3y ago
    All with similar sounding names but vastly different purposes.
- RajT88 3y ago
  I've always described Microsoft to people thusly: "Microsoft is a many-headed beast. Some heads are benevolent. Some less so." > Microsoft is said to be a collection of almost independent companies sharing a domain and a CEO. Fairly true.
LikelyABurner 3y ago
There is a very strong professional code of conduct within security circles that you should monetize the security of your own product as little as possible, because your own security is not a revenue stream, it's your most basic obligation to your customer. Like everything else in life, there's always trade-offs here, say, promoting your security practices to attract customers, but the general rule is that moment you start having different tiers of protection, you start venturing into some seriously morally grey areas. Microsoft didn't just start venturing into morally grey areas, they decided to set up their entire business model there, to the point that they didn't even know that they were hacked because they couldn't generate revenue from that knowledge. THAT'S why Microsoft deserves every piece of bad press it's getting right now. Not that they had a security incident (everyone will have security incidents), it's that they deliberately ignored accepted industry standards to do so, and to this day they're stonewalling efforts to assess the full impact.
- deleted 3y ago
  [deleted]

bayindirh 3y ago

I think yes, you’re off base. Microsoft got their MSA secret stolen, allowing China to read government emails. Do you need another example? https://www.theregister.com/AMP/2023/09/06/microsoft_stolen_key_analysis/ https://www.theregister.com/AMP/2023/09/06/microsoft_stolen_...

twisteriffic 3y ago
Also Microsoft still does not know how that secret was stolen and has knowingly mislead customers and the media about that fact. https://www.dhs.gov/news/2024/04/02/cyber-safety-review-board-releases-report-microsoft-online-exchange-incident-summer https://www.dhs.gov/news/2024/04/02/cyber-safety-review-boar...
- deleted 3y ago
  [deleted]
HillRat 3y ago
Specifically, a vintage 2016, unrevokable consumer signing key that was inadvertently allowed to sign identity tokens for enterprise substrates, which is a whole security house of cards.

ralph84 3y ago

Agreed. Almost all of the quotes are from Microsoft competitors shilling their wares.

wcchandler 3y ago

Yes, you are offbase. This is a fairly well written article that highlights and summarizes a few of their most recent gaffs. We recently re-evaluated our EDR solution and Microsoft was in the final 3. We didn't move them past the RFI process because of these recent incidents, on top of a very poorly packaged product (Defender). Microsoft has been really pushing the notion they're a security company (and my 401k would love it if that were true), but the sad reality is they continue to fall short in every possible way. I'll likely share this article with my peers when challenged on why we didn't move forward with them in our EDR project.

gjsman-1000 3y ago
Microsoft Defender was, and is, an inexcusably poorly thought through product. Just the branding - the name and logo is exactly the same as Windows Defender. It even puts an icon in the taskbar tray, resulting in two identical logos for two identically named products that do completely different things. No idea what they were thinking there. It seems they thought that the separation in consumers’ minds between “Microsoft” and “Windows” was strong, which it absolutely is not.
- panzi 3y ago
  When I google for Windows Defender I only get hits for Microsoft Defender. What is it? I don't use Windows anymore.
  - gjsman-1000 3y ago
    Microsoft Defender for Individuals: https://www.microsoft.com/en-us/microsoft-365/blog/2022/06/16/introducing-microsoft-defender-a-new-microsoft-365-online-security-app-for-you-and-your-family/ https://www.microsoft.com/en-us/microsoft-365/blog/2022/06/1... Windows Defender aka Windows Security: https://support.microsoft.com/en-us/windows/stay-protected-with-windows-security-2ae0363d-0ada-c064-8b56-6a39afb6a963 https://support.microsoft.com/en-us/windows/stay-protected-w... Microsoft Defender XDR (completely different thing, previously known as Microsoft Defender for 365): https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-xdr https://www.microsoft.com/en-us/security/business/siem-and-x... Microsoft Defender for Endpoint (also a different thing, basically XDR lite): https://www.microsoft.com/en-us/security/business/endpoint-security/microsoft-defender-endpoint https://www.microsoft.com/en-us/security/business/endpoint-s...

resource_waste 3y ago

I am unsure if ancient tech companies doing well is an indicator of quality. Sales teams and various vendor lockouts/ins can cause people to bend the knee. I accidentally pay $70/mo to microsoft because I bought wrong licenses that I needed only to serve a customer. Up until I started this company, I was 0% Microsoft.

Arnt 3y ago

You're right and wrong. I know about a team that does well and one that I think is begging for a major CVE. Microsoft is said to be a collection of almost independent companies sharing a domain and a CEO. Based on my experience, small as it is, I can believe it.

patmorgan23 3y ago
It's a flotilla of product ships sailing in the same general direction (hopefully)
- nmcveity 3y ago
  All with similar sounding names but vastly different purposes.
RajT88 3y ago
I've always described Microsoft to people thusly: "Microsoft is a many-headed beast. Some heads are benevolent. Some less so." > Microsoft is said to be a collection of almost independent companies sharing a domain and a CEO. Fairly true.

LikelyABurner 3y ago

There is a very strong professional code of conduct within security circles that you should monetize the security of your own product as little as possible, because your own security is not a revenue stream, it's your most basic obligation to your customer. Like everything else in life, there's always trade-offs here, say, promoting your security practices to attract customers, but the general rule is that moment you start having different tiers of protection, you start venturing into some seriously morally grey areas. Microsoft didn't just start venturing into morally grey areas, they decided to set up their entire business model there, to the point that they didn't even know that they were hacked because they couldn't generate revenue from that knowledge. THAT'S why Microsoft deserves every piece of bad press it's getting right now. Not that they had a security incident (everyone will have security incidents), it's that they deliberately ignored accepted industry standards to do so, and to this day they're stonewalling efforts to assess the full impact.

deleted 3y ago
[deleted]