3 ms·

Every Microsoft employee is now being judged on their security work

ThrowawayB7 2y ago
Everything old is new again: https://en.wikipedia.org/wiki/Trustworthy_computing https://en.wikipedia.org/wiki/Trustworthy_computing But, of course, there's not a peep about TwC in the memo.
- ForOldHack 2y ago
  They didn't read the memo. "Mynd you, møøse bites Kan be pretty nasti..."
politelemon 2y ago
This can only be a good thing, as long as it doesn't fall victim to pointless upper management driven metrics (Goodhart's law, "When a measure becomes a target, it ceases to be a good measure"), but qualitative ones instead
- ForOldHack 2y ago
  The raisin de etre for upper management is pointless bean counter driven metrics.
  - thefz 2y ago
    Raison*
    - BrandoElFollito 2y ago
      Raison d'être - to be complete I did not know that this expression was common outside of France.
      - JohnFen 2y ago
        It's pretty common in my part of the US. Maybe even more common in the French-speaking parts?
      - ForOldHack 2y ago
        It is not. It's popular in literary circles, upscale magazines, and long winded discussions on ontology. I usually play language a lot looser in Korean. It may be my mood.
    - ForOldHack 2y ago
      Your Raison, my raisin. I did not see the requirement for perfect Franch.
generalizations 2y ago
[flagged]
- deleted 2y ago
  [deleted]
ForOldHack 2y ago
[flagged]
- deleted 2y ago
  [deleted]
deleted 2y ago
[deleted]
poikroequ 2y ago
How do they define "security" exactly? Does security include privacy? Will they pull back on all the advertising and tracking they've been forcing upon their users? Will they pull back from injecting AI into everything? How will this affect the backwards compatibility of Windows applications? It's pointless PR talk without explicitly stating specifics of how this is going to affect their products and services.
- pixl97 2y ago
  Their security, not yours.
scj 2y ago
Are features going to be de-prioritized in favour of hardening existing code? Or are employees expected to keep doing what they are doing just "with security in mind"? The article makes it sound like the later. Which will be about as effective as "thoughts and prayers."
- satisfice 2y ago
  exactly
moribvndvs 2y ago
I’ve been in situations where the top announces sweeping, high priority directives to assuage customers and the board, but have no concrete or cohesive plan so they just bounce the problem off the bottom of the hierarchy. It’s called ass covering, and it doesn’t usually work out very well.
gwbas1c 2y ago
This reads like it came from Microsoft's security initiative from 20 years ago. > Microsoft made it clear earlier this year that it was planning to make security its top priority, following years of security issues and mounting criticisms. Starting today, the software giant is now tying its security efforts to employee performance reviews. Back then, Microsoft held free conferences all over the US to discuss secure programming techniques. That being said, I've encountered some developers who, because they weren't around 20 years ago, make boneheaded security mistakes. Penalizing developers in performance reviews for (cough) obvious, unprofessional security flaws is rather important.
nhance 2y ago
I have this theory I cannot prove that Microsoft has had an existential level security breach, something like a full access breach to all of Azure, but it is covered up in a "too big to fail" type manner. I have absolutely no way to prove this gut feeling.
synicalx 2y ago
I'm kind of surprised this wasn't already a thing. Are we to believe that up until literally today, most employees at MS didn't have to think about security? The same MS who's products and platforms are certified for use in, and also actively used in defence, banking, health etc.
ochronus 2y ago
Theatre
rsynnott 2y ago
> Microsoft employees will have to demonstrate how they’ve made impactful security changes. What if you’re, say, a graphic designer or something? “The Windows 12 default wallpaper is extra-secure”.
almatabata 2y ago
Can we get the people judged that allegedly did not prioritize critical security issues properly: https://www.propublica.org/article/microsoft-solarwinds-golden-saml-data-breach-russian-hackers https://www.propublica.org/article/microsoft-solarwinds-gold...

Everything old is new again: https://en.wikipedia.org/wiki/Trustworthy_computing https://en.wikipedia.org/wiki/Trustworthy_computing But, of course, there's not a peep about TwC in the memo.

ForOldHack 2y ago
They didn't read the memo. "Mynd you, møøse bites Kan be pretty nasti..."

politelemon 2y ago

This can only be a good thing, as long as it doesn't fall victim to pointless upper management driven metrics (Goodhart's law, "When a measure becomes a target, it ceases to be a good measure"), but qualitative ones instead

ForOldHack 2y ago
The raisin de etre for upper management is pointless bean counter driven metrics.
- thefz 2y ago
  Raison*
  - BrandoElFollito 2y ago
    Raison d'être - to be complete I did not know that this expression was common outside of France.
    - JohnFen 2y ago
      It's pretty common in my part of the US. Maybe even more common in the French-speaking parts?
    - ForOldHack 2y ago
      It is not. It's popular in literary circles, upscale magazines, and long winded discussions on ontology. I usually play language a lot looser in Korean. It may be my mood.
  - ForOldHack 2y ago
    Your Raison, my raisin. I did not see the requirement for perfect Franch.

generalizations 2y ago

[flagged]

deleted 2y ago
[deleted]

ForOldHack 2y ago

[flagged]

deleted 2y ago
[deleted]

deleted 2y ago

[deleted]

poikroequ 2y ago

How do they define "security" exactly? Does security include privacy? Will they pull back on all the advertising and tracking they've been forcing upon their users? Will they pull back from injecting AI into everything? How will this affect the backwards compatibility of Windows applications? It's pointless PR talk without explicitly stating specifics of how this is going to affect their products and services.

pixl97 2y ago
Their security, not yours.

scj 2y ago

Are features going to be de-prioritized in favour of hardening existing code? Or are employees expected to keep doing what they are doing just "with security in mind"? The article makes it sound like the later. Which will be about as effective as "thoughts and prayers."

satisfice 2y ago
exactly

moribvndvs 2y ago

I’ve been in situations where the top announces sweeping, high priority directives to assuage customers and the board, but have no concrete or cohesive plan so they just bounce the problem off the bottom of the hierarchy. It’s called ass covering, and it doesn’t usually work out very well.

gwbas1c 2y ago

This reads like it came from Microsoft's security initiative from 20 years ago. > Microsoft made it clear earlier this year that it was planning to make security its top priority, following years of security issues and mounting criticisms. Starting today, the software giant is now tying its security efforts to employee performance reviews. Back then, Microsoft held free conferences all over the US to discuss secure programming techniques. That being said, I've encountered some developers who, because they weren't around 20 years ago, make boneheaded security mistakes. Penalizing developers in performance reviews for (cough) obvious, unprofessional security flaws is rather important.

nhance 2y ago

I have this theory I cannot prove that Microsoft has had an existential level security breach, something like a full access breach to all of Azure, but it is covered up in a "too big to fail" type manner. I have absolutely no way to prove this gut feeling.

synicalx 2y ago

I'm kind of surprised this wasn't already a thing. Are we to believe that up until literally today, most employees at MS didn't have to think about security? The same MS who's products and platforms are certified for use in, and also actively used in defence, banking, health etc.

ochronus 2y ago

Theatre

rsynnott 2y ago

> Microsoft employees will have to demonstrate how they’ve made impactful security changes. What if you’re, say, a graphic designer or something? “The Windows 12 default wallpaper is extra-secure”.

almatabata 2y ago

Can we get the people judged that allegedly did not prioritize critical security issues properly: https://www.propublica.org/article/microsoft-solarwinds-golden-saml-data-breach-russian-hackers https://www.propublica.org/article/microsoft-solarwinds-gold...