6 ms·

That testimony was so empty, and the fawning over Smith's "acceptance of responsibility" felt silly given they've demonstrated no real plan for correcting their

That testimony was so empty, and the fawning over Smith's "acceptance of responsibility" felt silly given they've demonstrated no real plan for correcting their course and rectifying their past mistakes. In addition to the things pointed out in the article, some highlights from watching it myself: * Smith mentioned that individual contributors (ICs) will have security as a part of their individual assessments affecting their take home pay, but further digging revealed that this could be as little as 3% of their salary, and much less when factoring in stock. And, project managers are not subject to this. His response to that was people love to get straight A's in Silicon Valley. This feels like a way for them to place future blame on ICs. * At one point concern was raised about ransomware's impact on rural hospitals. Smith said they were working with hospitals to give them discounts of 75% or even free, for the first year. I would've liked to see them talk about why security is a paid for add-on instead of necessary part of the base product. * On that ransomware point, Smith said the best solution was to pressure Moscow to stop their people from deploying ransomware, while rambling on about our alliance with the Soviet Union in World War 2. What a silly, ineffective approach and silly tangent to go on. * He talked about how finding these security issue was everyone's job and how happy he was that the State Department had brought one such issue to their attention. I was happy to see when one of the representatives pointed out that the government pays them to do that job, specifically. * He seem woefully under-prepared to talk specifics about some questions, but to me it just felt like there weren't good answers and feigning lack of knowledge was a way to sidestep the line of questioning. * When it came to Recall, he liked to talk about how it wasn't a "released" product and praised themselves on the changes they'd made to their approaches, conveniently leaving out that many of the flaws in their approach were pointed out after their "non-releases" to the public. All in all, Brad Smith's answers were mostly empty, often pandering, and deceptively self-aggrandizing (self being Microsoft). Admittedly, I didn't have a high opinion of Microsoft before this hearing, but this definitely made me think even less of them. The government needs to take a long hard look at their vendors' and their own approaches to software security.

tonetegeatinst 2y ago
Yeah even windows 10 was seen as a privacy nightmare, but iv always know Microsoft just blows when it comes to security. They just don't patch shit sometimes, I can't trust they arnt backdoored. They charge users for the product while mining user data. I knew it would be BS corporate speech, like it always is from them and certain companies. Its just sad to see this happen
blackeyeblitzar 2y ago
Thanks for the detailed summary. I agree with your characterization of it being a mix of empty pandering and deceptive self-aggrandizement. But then again this is Microsoft. They have thrived on acting unethically just below the level of facing serious legal or regulatory consequences. Pointing fingers at ICs or the bizarre tangent about the USSR seems like a strategy engineered to gently deflect and distract while pretending to bear responsibility. But make no mistake - the weak legislators that won’t act against the cabal of giant tech companies are just as or even more guilty.
- hulitu 2y ago
  > But make no mistake - the weak legislators that won’t act against the cabal of giant tech companies are just as or even more guilty. They can't bite the hand that feeds them.
pjmlp 2y ago
You see this difference between what is said and done in multiple places, where WinDev has influece, versus other business units like DevDiv and Azure. Hilo was a kind of response to the Longhorn development approach based on .NET, but using COM and C++ instead. Some surviving stuff, https://devblogs.microsoft.com/cppblog/announcing-hilo/ https://devblogs.microsoft.com/cppblog/announcing-hilo/ "So overall C++ is a good choice for writing Windows 7-based applications. It has the correct balance of the raw power and flexibility of C, and the sophisticated language features of C#. C++ as a compiled language produces executable code that is as close to the Windows API as is possible and, indeed, the C++ compiler optimizer will make the code as efficient as possible. The C++ compiler has many of options to allow the developer to choose the best optimization, and Microsoft’s C++ compiler is one the best ways to produce small, fast code. With such power and flexibility there are potential pitfalls, of course. The chief problem with C++ is the issue of memory management, but since it is a mature language, standard solutions have been developed, for example smart pointers. There are many established standard libraries and their longevity and maturity means that they are broadly used and tested and so can be trusted to be stable." Taken from https://learn.microsoft.com/en-us/previous-versions/msdn10/ff795785(v=msdn.10) https://learn.microsoft.com/en-us/previous-versions/msdn10/f... Followed by WinRT/UWP, being pretty much a revamped COM, with C++, and .NET bindings (although not for all WinRT scenarios). Which has pretty much stayed this way, and why .NET is more successful on Azure and cross-platform, than on Windows itself. So still looking forward when WinDev will take security more seriously.
- neonsunset 2y ago
  As of now, I think almost the entirety of WinRT should be accessible from .NET via https://github.com/microsoft/CsWinRT https://github.com/microsoft/CsWinRT There is also a pre-release which enables NativeAOT support (note that AOT compatibility there is driven by individual engineers that want to make it happen, there are no "instituted from above" projects regarding it but I may be wrong)
  - pjmlp 2y ago
    There are still no proper bindings for DirectX, Win2D (full API surface as in C++ UWP version), Windows 11 context menus, shell extensions, and plenty other stuff. Additionally the folks in WinAppSdk apparently never used .NET as they keep coming up with writing C in C# APIs. It wasn't after lots of complaints that WinUI 3.0 Windows, finally got as usable from .NET as in Forms and WPF, instead of the calling directly Win32 boilerplate. Kudos to those engineers, unfortunately it has been the .NET story on WinDev side, many would rather that their world would have kept being VB 6, MFC and ATL. There is even a Build session on this. Even projects like Managed DirectX and XNA, grew out of such engineers, only to die after they weren't no longer around to argue for them, and DirectX TK was born.
kotaKat 2y ago
> Smith said they were working with hospitals to give them discounts of 75% or even free, for the first year I was part of a helpdesk at a hospital system that took over a rural hospital that didn't even have net 30. Every IT vendor wanted cash up front. I'd love to try to figure out how finance will work in Microsoft's extortion in a year so they can save themselves from another Ryuk.

tonetegeatinst 2y ago

Yeah even windows 10 was seen as a privacy nightmare, but iv always know Microsoft just blows when it comes to security. They just don't patch shit sometimes, I can't trust they arnt backdoored. They charge users for the product while mining user data. I knew it would be BS corporate speech, like it always is from them and certain companies. Its just sad to see this happen

blackeyeblitzar 2y ago

Thanks for the detailed summary. I agree with your characterization of it being a mix of empty pandering and deceptive self-aggrandizement. But then again this is Microsoft. They have thrived on acting unethically just below the level of facing serious legal or regulatory consequences. Pointing fingers at ICs or the bizarre tangent about the USSR seems like a strategy engineered to gently deflect and distract while pretending to bear responsibility. But make no mistake - the weak legislators that won’t act against the cabal of giant tech companies are just as or even more guilty.

hulitu 2y ago
> But make no mistake - the weak legislators that won’t act against the cabal of giant tech companies are just as or even more guilty. They can't bite the hand that feeds them.

pjmlp 2y ago

You see this difference between what is said and done in multiple places, where WinDev has influece, versus other business units like DevDiv and Azure. Hilo was a kind of response to the Longhorn development approach based on .NET, but using COM and C++ instead. Some surviving stuff, https://devblogs.microsoft.com/cppblog/announcing-hilo/ https://devblogs.microsoft.com/cppblog/announcing-hilo/ "So overall C++ is a good choice for writing Windows 7-based applications. It has the correct balance of the raw power and flexibility of C, and the sophisticated language features of C#. C++ as a compiled language produces executable code that is as close to the Windows API as is possible and, indeed, the C++ compiler optimizer will make the code as efficient as possible. The C++ compiler has many of options to allow the developer to choose the best optimization, and Microsoft’s C++ compiler is one the best ways to produce small, fast code. With such power and flexibility there are potential pitfalls, of course. The chief problem with C++ is the issue of memory management, but since it is a mature language, standard solutions have been developed, for example smart pointers. There are many established standard libraries and their longevity and maturity means that they are broadly used and tested and so can be trusted to be stable." Taken from https://learn.microsoft.com/en-us/previous-versions/msdn10/ff795785(v=msdn.10) https://learn.microsoft.com/en-us/previous-versions/msdn10/f... Followed by WinRT/UWP, being pretty much a revamped COM, with C++, and .NET bindings (although not for all WinRT scenarios). Which has pretty much stayed this way, and why .NET is more successful on Azure and cross-platform, than on Windows itself. So still looking forward when WinDev will take security more seriously.

neonsunset 2y ago
As of now, I think almost the entirety of WinRT should be accessible from .NET via https://github.com/microsoft/CsWinRT https://github.com/microsoft/CsWinRT There is also a pre-release which enables NativeAOT support (note that AOT compatibility there is driven by individual engineers that want to make it happen, there are no "instituted from above" projects regarding it but I may be wrong)
- pjmlp 2y ago
  There are still no proper bindings for DirectX, Win2D (full API surface as in C++ UWP version), Windows 11 context menus, shell extensions, and plenty other stuff. Additionally the folks in WinAppSdk apparently never used .NET as they keep coming up with writing C in C# APIs. It wasn't after lots of complaints that WinUI 3.0 Windows, finally got as usable from .NET as in Forms and WPF, instead of the calling directly Win32 boilerplate. Kudos to those engineers, unfortunately it has been the .NET story on WinDev side, many would rather that their world would have kept being VB 6, MFC and ATL. There is even a Build session on this. Even projects like Managed DirectX and XNA, grew out of such engineers, only to die after they weren't no longer around to argue for them, and DirectX TK was born.

kotaKat 2y ago

> Smith said they were working with hospitals to give them discounts of 75% or even free, for the first year I was part of a helpdesk at a hospital system that took over a rural hospital that didn't even have net 30. Every IT vendor wanted cash up front. I'd love to try to figure out how finance will work in Microsoft's extortion in a year so they can save themselves from another Ryuk.