3 ms·

In addition to direct market reaction, they must be a bit red in the face considering that Apple just laid out a complex and well thought out implementation of

In addition to direct market reaction, they must be a bit red in the face considering that Apple just laid out a complex and well thought out implementation of "AI", which focused on privacy. As someone who grew up near Redmond, who still has an emotional soft-spot for Microsoft for some reason, I feel truly embarrassed for their implementation.

pjmlp 2y ago
From all three major OS vendors on the consumer market, Microsoft is still the one that pushes more C and C++ into production on their OS, in detriment of .NET, despite all the security discussions. All the efforts from other teams to have .NET reach Swift, Java, Kotlin levels of adoption on Windows, have always hit a wall against WinDev culture. Also the 90's spirit from features over security hasn't yet gone away from WinDev, so it isn't really surprising this turned out this way.
- consumer451 2y ago
  My personal feelings aside, Microsoft is Too Big to Suck like this, regarding security and privacy. At this point, their culture is a national security liability. We have seen some recent efforts, but how does one right such a large ship? https://www.theregister.com/2024/06/14/brad_smith_microsoft_hearing/ https://www.theregister.com/2024/06/14/brad_smith_microsoft_... https://www.theverge.com/2024/4/3/24119787/microsoft-cloud-email-hack-china-us-cyber-report https://www.theverge.com/2024/4/3/24119787/microsoft-cloud-e...
  - creshal 2y ago
    Your post could've been written in 2004, when Microsoft was pinky swearing it was gonna refocus on security-first development, starting with XP SP2
    - consumer451 2y ago
      To be a bit fair, Windows security has gone from a laughing stock in 2004, to having Windows Defender in the 2020s. I ain't no city slickin' infosec guy, but Defender appears to be state of the art end point protection today. They can figure this stuff out sometimes, right? How did they get from Windows/AVG/ESET to Windows Defender, and how can they make that happen on Azure?
      - pjmlp 2y ago
        Azure is much more secure than regular Windows.
      - keyringlight 2y ago
        To me this seems like a different aspect of security. The push with the winxp service packs onwards was to make it secure by default against the network (trying to be vague because I'll probably be wrong on the details), I'm fairly sure it was xp where you could be infected before setup was complete if the network was plugged in, or that acquiring third party AV was something you must do for anything that touches the internet or media from a source you can't 100% trust. Now with defender this is far in the background for most users that they don't need to think about it at all. The difference with recall is about blast radius of any unauthorized/unintended access, which still happens even if it's less common or via something like clicking a bad link in an email. That's in addition to mistrust of MS or large corporations sucking up data, and how secure they are (what would a Ashley Madison type breach look like with recall data?)
    - pjmlp 2y ago
      They did improve their story, with SAL exactly introduced for XP SP2, and having for many years having one of the few C++ standard libraries with bounds checking enabled by default in debug builds. However that was it, WinDev fought against Longhorn, Office folks redid the .NET ideas in COM for Vista, and so on.
  - pjmlp 2y ago
    The same way as .NET FOSS, MS <3 Linux and such happened, by having a captain on the bridge that actually cares to make it happen, not sure if that is still Satya though.
    - consumer451 2y ago
      If I understand the modern security issues correctly, this is all happening on Azure, correct? Windows is relatively secure, but their cloud has too much legacy compatibility/tech debt? For example, Kerberos support in Azure AD led to the some of the latest issues?
      - pjmlp 2y ago
        On the contrary, Azure has a much better security culture than Windows business unit. Most stuff is built with .NET, Go, Java and Rust, while the hypervisors are based on Windows (Azure Host OS[0]) it isn't the same as regular Windows, and most workloads are Linux based, officially > 60% [1]. Finally, starting this year, Azure has new security guidelines, all new software is to be written in managed languages, if a GC is not an impediment, Rust otherwise. Writing code in either C or C++, is only allowed for existing products, with the related security guidelines in place[2]. [0] - https://techcommunity.microsoft.com/t5/windows-os-platform-blog/azure-host-os-cloud-host/ba-p/3709528 https://techcommunity.microsoft.com/t5/windows-os-platform-b... [1] - https://azure.microsoft.com/en-us/products/virtual-machines/linux https://azure.microsoft.com/en-us/products/virtual-machines/... [2] - https://x.com/dwizzzleMSFT/status/1720134540822520268 https://x.com/dwizzzleMSFT/status/1720134540822520268
        consumer451 2y ago
        Thank you, I really appreciate this response. I need to read all of this. However, the most recent compromises did happen on Azure, and not Windows, correct? edit: and of course that's where the threat actors put their focus, because that's where the data lived.
        pjmlp 2y ago
  - DaiPlusPlus 2y ago
    Put DevDiv’s bosses in charge of WinDev.
    - pjmlp 2y ago
      I fear they would riot. :)
- Gormo 2y ago
  It's too bad that the rest of the "90's spirit" -- consistent, well-organized UIs, users controlling their own computers, and software that runs locally without dependence on cloud servers -- seems to be receding at Microsoft, leaving everyone with the worst of both worlds.
slashdave 2y ago
My suspicion is that Microsoft learned of Apple's effort, thus this rushed, skunkworks implementation, pushed to be released before Apple. The effort backfired spectacularly.
- consumer451 2y ago
  I worry that it's worse. They have been working on this for years, but I think that they may have assumed that their desktop market dominance was so sound, that they just didn't care to put the effort into privacy. What are you going to do, Linux Desktop? This seems like the general attitude that delivers lackluster solutions across many products, like Teams, SharePoint, etc.

pjmlp 2y ago

From all three major OS vendors on the consumer market, Microsoft is still the one that pushes more C and C++ into production on their OS, in detriment of .NET, despite all the security discussions. All the efforts from other teams to have .NET reach Swift, Java, Kotlin levels of adoption on Windows, have always hit a wall against WinDev culture. Also the 90's spirit from features over security hasn't yet gone away from WinDev, so it isn't really surprising this turned out this way.

consumer451 2y ago
My personal feelings aside, Microsoft is Too Big to Suck like this, regarding security and privacy. At this point, their culture is a national security liability. We have seen some recent efforts, but how does one right such a large ship? https://www.theregister.com/2024/06/14/brad_smith_microsoft_hearing/ https://www.theregister.com/2024/06/14/brad_smith_microsoft_... https://www.theverge.com/2024/4/3/24119787/microsoft-cloud-email-hack-china-us-cyber-report https://www.theverge.com/2024/4/3/24119787/microsoft-cloud-e...
- creshal 2y ago
  Your post could've been written in 2004, when Microsoft was pinky swearing it was gonna refocus on security-first development, starting with XP SP2
  - consumer451 2y ago
    To be a bit fair, Windows security has gone from a laughing stock in 2004, to having Windows Defender in the 2020s. I ain't no city slickin' infosec guy, but Defender appears to be state of the art end point protection today. They can figure this stuff out sometimes, right? How did they get from Windows/AVG/ESET to Windows Defender, and how can they make that happen on Azure?
    - pjmlp 2y ago
      Azure is much more secure than regular Windows.
    - keyringlight 2y ago
      To me this seems like a different aspect of security. The push with the winxp service packs onwards was to make it secure by default against the network (trying to be vague because I'll probably be wrong on the details), I'm fairly sure it was xp where you could be infected before setup was complete if the network was plugged in, or that acquiring third party AV was something you must do for anything that touches the internet or media from a source you can't 100% trust. Now with defender this is far in the background for most users that they don't need to think about it at all. The difference with recall is about blast radius of any unauthorized/unintended access, which still happens even if it's less common or via something like clicking a bad link in an email. That's in addition to mistrust of MS or large corporations sucking up data, and how secure they are (what would a Ashley Madison type breach look like with recall data?)
  - pjmlp 2y ago
    They did improve their story, with SAL exactly introduced for XP SP2, and having for many years having one of the few C++ standard libraries with bounds checking enabled by default in debug builds. However that was it, WinDev fought against Longhorn, Office folks redid the .NET ideas in COM for Vista, and so on.
- pjmlp 2y ago
  The same way as .NET FOSS, MS <3 Linux and such happened, by having a captain on the bridge that actually cares to make it happen, not sure if that is still Satya though.
  - consumer451 2y ago
    If I understand the modern security issues correctly, this is all happening on Azure, correct? Windows is relatively secure, but their cloud has too much legacy compatibility/tech debt? For example, Kerberos support in Azure AD led to the some of the latest issues?
    - pjmlp 2y ago
      On the contrary, Azure has a much better security culture than Windows business unit. Most stuff is built with .NET, Go, Java and Rust, while the hypervisors are based on Windows (Azure Host OS[0]) it isn't the same as regular Windows, and most workloads are Linux based, officially > 60% [1]. Finally, starting this year, Azure has new security guidelines, all new software is to be written in managed languages, if a GC is not an impediment, Rust otherwise. Writing code in either C or C++, is only allowed for existing products, with the related security guidelines in place[2]. [0] - https://techcommunity.microsoft.com/t5/windows-os-platform-blog/azure-host-os-cloud-host/ba-p/3709528 https://techcommunity.microsoft.com/t5/windows-os-platform-b... [1] - https://azure.microsoft.com/en-us/products/virtual-machines/linux https://azure.microsoft.com/en-us/products/virtual-machines/... [2] - https://x.com/dwizzzleMSFT/status/1720134540822520268 https://x.com/dwizzzleMSFT/status/1720134540822520268
      - consumer451 2y ago
        Thank you, I really appreciate this response. I need to read all of this. However, the most recent compromises did happen on Azure, and not Windows, correct? edit: and of course that's where the threat actors put their focus, because that's where the data lived.
        pjmlp 2y ago
- DaiPlusPlus 2y ago
  Put DevDiv’s bosses in charge of WinDev.
  - pjmlp 2y ago
    I fear they would riot. :)
Gormo 2y ago
It's too bad that the rest of the "90's spirit" -- consistent, well-organized UIs, users controlling their own computers, and software that runs locally without dependence on cloud servers -- seems to be receding at Microsoft, leaving everyone with the worst of both worlds.

slashdave 2y ago

My suspicion is that Microsoft learned of Apple's effort, thus this rushed, skunkworks implementation, pushed to be released before Apple. The effort backfired spectacularly.

consumer451 2y ago
I worry that it's worse. They have been working on this for years, but I think that they may have assumed that their desktop market dominance was so sound, that they just didn't care to put the effort into privacy. What are you going to do, Linux Desktop? This seems like the general attitude that delivers lackluster solutions across many products, like Teams, SharePoint, etc.