4 ms·

> and the mega corp, like Facebook will only just barely experience anything like this because it’s just not that important. I worked at Microsoft, and speakin

> and the mega corp, like Facebook will only just barely experience anything like this because it’s just not that important. I worked at Microsoft, and speaking to their security team my impression was that MSFT is under persistent attack from nation states on a non stop basis, up to and including working to get government assets hired to work at Microsoft to leak secrets out. Given the importance of AWS, I have no doubt Amazon is under similar threat.

thinkingtoilet 2y ago
I would imagine Microsoft is a bit different because of the OS. If you can hack Windows you have access to nearly every institution in the world. Linux and iOS don't have that reach. No need to hack AWS, you hacked the computer that is logging into AWS.
- mrkeen 2y ago
  Why rob a bank when you can pickpocket a guy walking into the bank instead? Anyway Linux has 62.7% share of servers https://en.m.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.m.wikipedia.org/wiki/Usage_share_of_operating_sys...
- soulofmischief 2y ago
  The majority of cloud infrastructure is run on Linux. You're saying there's no need to hack Linux when it's easier to hack Windows, and therefore Microsoft has better security fundamentals as the providers of a less secure but more prevalent OS? I don't follow the argument.
  - com2kid 2y ago
    If someone has a 0 day backdoor to Windows, they can steal the credentials from the employees who are logging into those Linux servers. Many high value servers don't have public IPs, and the really juicy ones are behind jump boxes. At that point the OS on the server isn't relevant.
    - soulofmischief 2y ago
      But how does Microsoft having better security fundamentals follow from that? The extent of pwnage possible doesn't magically make them follow best practices.
filoleg 2y ago
For Microsoft to be in such a position makes sense, as they provide services for both US military and government (which also includes agencies), as well as for some infrastructure services. This is a pretty unique situation, compared to most other big tech companies. Hell, there is a whole “Azure for US Government” product out there just for that, and that’s in addition to the usual AD/OneDrive/SharePoint/Windows/etc. suspects.

thinkingtoilet 2y ago

I would imagine Microsoft is a bit different because of the OS. If you can hack Windows you have access to nearly every institution in the world. Linux and iOS don't have that reach. No need to hack AWS, you hacked the computer that is logging into AWS.

mrkeen 2y ago
Why rob a bank when you can pickpocket a guy walking into the bank instead? Anyway Linux has 62.7% share of servers https://en.m.wikipedia.org/wiki/Usage_share_of_operating_systems https://en.m.wikipedia.org/wiki/Usage_share_of_operating_sys...
soulofmischief 2y ago
The majority of cloud infrastructure is run on Linux. You're saying there's no need to hack Linux when it's easier to hack Windows, and therefore Microsoft has better security fundamentals as the providers of a less secure but more prevalent OS? I don't follow the argument.
- com2kid 2y ago
  If someone has a 0 day backdoor to Windows, they can steal the credentials from the employees who are logging into those Linux servers. Many high value servers don't have public IPs, and the really juicy ones are behind jump boxes. At that point the OS on the server isn't relevant.
  - soulofmischief 2y ago
    But how does Microsoft having better security fundamentals follow from that? The extent of pwnage possible doesn't magically make them follow best practices.

filoleg 2y ago

For Microsoft to be in such a position makes sense, as they provide services for both US military and government (which also includes agencies), as well as for some infrastructure services. This is a pretty unique situation, compared to most other big tech companies. Hell, there is a whole “Azure for US Government” product out there just for that, and that’s in addition to the usual AD/OneDrive/SharePoint/Windows/etc. suspects.