7 ms·

Another day another vulnerability with Microsoft. I wonder if this will incentivize the countries to move faster with Linux. Probably not since there are so m

by jmclnx 1y ago

Another day another vulnerability with Microsoft. I wonder if this will incentivize the countries to move faster with Linux. Probably not since there are so many of these breaches people just ignore them. I miss the old days when a breach involved someone breaking into the computer room and grabbing as many mag tapes as they can carry and run :)

sivm 1y ago
I operate under the assumption that open source projects are compromised by states. If you espouse unpopular ideas or are yourself a state don’t rely on it.
- jmclnx 1y ago
  Lets pretend what you are saying is true, which it is not. Who would you want to access your data ? The State or the "underworld". Many countries have laws on how to access your data. The underworld, you may wake up dead. Granted there are countries that act like a Criminal Org., but if you live there you have more issues than your data. With proprietary software, it is a much larger chance that backdoors exist than in Open Source. Many of us heard of 1 issue where it was claimed a project had a Gov sponsored BH in it. They did a long audit and found that was false. Eventually Open Source backdoors will found in Open Systems. Proprietary you are SOL unless you do very expensive and very hard testing. Even then it is doubtful you will find a backdoor.
  - pessimizer 1y ago
    It is true. Denying trivial truths with the purpose of not giving an inch does not add to one's argument, it weakens it. Plenty of closed source products will happily backdoor their products on request, without a warrant, if they are confident they will never be found out. That's the point. Not that FOSS source is somehow inviolable to nation-states with virtually infinite resources, many of which sponsor or contribute to the finance of a huge percentage of the development of FOSS themselves. It's easier to find backdoors in FOSS if you're looking, because you're allowed to look. But somebody has to be looking.
- temp0826 1y ago
  Interesting, I'd more likely assume the same for closed source projects as there is less transparency into the supply chain
- fsflover 1y ago
  https://news.ycombinator.com/item?id=27897975 https://news.ycombinator.com/item?id=27897975
- BobbyTables2 1y ago
  It’d be cheaper and quieter to compromise a few key employees in a private company…
SketchySeaBeast 1y ago
Genuinely asking - is there a Linux alternative to Sharepoint? I couldn't care less if it was lit on metaphorical fire and dumped into the sea, but a lot of orgs using it extensively.
- bangaladore 1y ago
  O365 is a poor amalgamation of like 18 different things. Quite frankly I hope there isn't a true "alternative" to it. The reason orgs use Sharepoint is they are forced to if they use Microsoft. One drive is sharepoint, teams is sharepoint, sharepoint sites is sharepoint, etc... I'm sure all those things have better alternatives, but Microsoft shoves them down your throat when you license with them.
  - SketchySeaBeast 1y ago
    But it's understandable why an org would prefer that to having to maintain and manage the 18 things, right? It's a hard sell. I'm not saying that wouldn't be better, but it makes sense why an org would be reluctant. Again, not a fan of Sharepoint myself, but from an org's viewpoint, moving to Linux raises more problems than it solves.
    - bangaladore 1y ago
      It's understandable, but it doesn't excuse how poorly everything actually works and how confusing it is to use and administrate. To some extent I think Microsoft is largely in the business of building solutions for problems that don't exist. Most orgs are probably perfectly fine with a document management system + desktop word application and then a commercial NAS for bulk storage / backups.
  - kuhsaft 1y ago
    > Sharepoint is a poor amalgamation of like 18 different things. You’ve got it backwards. Everything M365 is an amalgamation of Entra, SharePoint, and Exchange.
lenerdenator 1y ago
Oh, don't worry, there's plenty of known, unpatched vulnerabilities in FOSS, too.
ho_schi 1y ago
I wonder what drives people using Microsoft and then using more from this company. We didn’t knew it better, back then. We knew it better, now. But migrating is work. So we prefer to suffer! And harm others! This Linux and BSD people are so annoying with their desire for compatibility. They shall suffer, too! And when we buy everything from a Monopoly, we don’t need to think. Somehow. Part of the game is that you’ve always an excuse with Microsoft. You cannot made responsible? There is this quote about IBM: Nobody Ever Got Fired for Buying IBM. But I cannot remember stories about suffering from IBM forever.
- dizlexic 1y ago
  From what I've seen in my industry? To pass all the liability to Microsoft. "If something happens, we used enterprise grade industry standard software. We did our due diligence." This outlook is basically why we can't innovate anymore. I had to recently sit through a meeting where our CTO quoted all the "blogs" he's been reading as a way to slap down my suggestion for an in-house project. It's all about CYA.
  - pphysch 1y ago
    Surely there's an untapped market for infosec liability insurance. Pay the CYA bill, let the engineers build/choose something that actually works. Win-win.
  - phil21 1y ago
    I call it the liabilty fairy. It's why school boards don't do anything useful, among many many other things in our society. It's an endemic disease. Most of the time it's extremely exaggerated, but it's trotted out and used as a CYA excuse almost immediately by most in the executive/managerial class. Both due to outright laziness and incompetence, and also as just a... why take any personal risk whatsoever making actual decisions with any impact if I can keep my cushy job and career rolling by being as milquetoast as possible. Never mind you get the big bucks to make such important and controversial decisions at great personal (career) risk when some inevitably go wrong. Everyone forgot that part. Such roles should be hard, difficult, and risky.
- 1y ago
hulitu 1y ago
> I wonder if this will incentivize the countries to move faster with Linux. Countries are run by politicians. The ability of a politician to remember something is inverse proportional to the sum of money landed in its account.
formerly_proven 1y ago
As far as I can tell there's two vulnerabilities bundled up here. One is an unauthenticated command injection (!) vulnerability to steal some keys and the other is of course yet another serialization-based RCE in a safe language, mediated by signed cookies (signed with the keys stolen in step 1). I don't understand how often this design has to blow up in people's faces until they stop doing this and use something dumb and safe instead.
vpShane 1y ago
> I wonder if this will incentivize the countries to move faster with Linux. I hope so. We're seeing it now though. Germany, Norway. Not saying there won't be CVEs when they move, but at least there's freedom and openness already available to switch to.

by jmclnx 1y ago

sivm 1y ago

I operate under the assumption that open source projects are compromised by states. If you espouse unpopular ideas or are yourself a state don’t rely on it.

jmclnx 1y ago
Lets pretend what you are saying is true, which it is not. Who would you want to access your data ? The State or the "underworld". Many countries have laws on how to access your data. The underworld, you may wake up dead. Granted there are countries that act like a Criminal Org., but if you live there you have more issues than your data. With proprietary software, it is a much larger chance that backdoors exist than in Open Source. Many of us heard of 1 issue where it was claimed a project had a Gov sponsored BH in it. They did a long audit and found that was false. Eventually Open Source backdoors will found in Open Systems. Proprietary you are SOL unless you do very expensive and very hard testing. Even then it is doubtful you will find a backdoor.
- pessimizer 1y ago
  It is true. Denying trivial truths with the purpose of not giving an inch does not add to one's argument, it weakens it. Plenty of closed source products will happily backdoor their products on request, without a warrant, if they are confident they will never be found out. That's the point. Not that FOSS source is somehow inviolable to nation-states with virtually infinite resources, many of which sponsor or contribute to the finance of a huge percentage of the development of FOSS themselves. It's easier to find backdoors in FOSS if you're looking, because you're allowed to look. But somebody has to be looking.
temp0826 1y ago
Interesting, I'd more likely assume the same for closed source projects as there is less transparency into the supply chain
fsflover 1y ago
https://news.ycombinator.com/item?id=27897975 https://news.ycombinator.com/item?id=27897975
BobbyTables2 1y ago
It’d be cheaper and quieter to compromise a few key employees in a private company…

SketchySeaBeast 1y ago

Genuinely asking - is there a Linux alternative to Sharepoint? I couldn't care less if it was lit on metaphorical fire and dumped into the sea, but a lot of orgs using it extensively.

bangaladore 1y ago
O365 is a poor amalgamation of like 18 different things. Quite frankly I hope there isn't a true "alternative" to it. The reason orgs use Sharepoint is they are forced to if they use Microsoft. One drive is sharepoint, teams is sharepoint, sharepoint sites is sharepoint, etc... I'm sure all those things have better alternatives, but Microsoft shoves them down your throat when you license with them.
- SketchySeaBeast 1y ago
  But it's understandable why an org would prefer that to having to maintain and manage the 18 things, right? It's a hard sell. I'm not saying that wouldn't be better, but it makes sense why an org would be reluctant. Again, not a fan of Sharepoint myself, but from an org's viewpoint, moving to Linux raises more problems than it solves.
  - bangaladore 1y ago
    It's understandable, but it doesn't excuse how poorly everything actually works and how confusing it is to use and administrate. To some extent I think Microsoft is largely in the business of building solutions for problems that don't exist. Most orgs are probably perfectly fine with a document management system + desktop word application and then a commercial NAS for bulk storage / backups.
- kuhsaft 1y ago
  > Sharepoint is a poor amalgamation of like 18 different things. You’ve got it backwards. Everything M365 is an amalgamation of Entra, SharePoint, and Exchange.

lenerdenator 1y ago

Oh, don't worry, there's plenty of known, unpatched vulnerabilities in FOSS, too.

ho_schi 1y ago

I wonder what drives people using Microsoft and then using more from this company. We didn’t knew it better, back then. We knew it better, now. But migrating is work. So we prefer to suffer! And harm others! This Linux and BSD people are so annoying with their desire for compatibility. They shall suffer, too! And when we buy everything from a Monopoly, we don’t need to think. Somehow. Part of the game is that you’ve always an excuse with Microsoft. You cannot made responsible? There is this quote about IBM: Nobody Ever Got Fired for Buying IBM. But I cannot remember stories about suffering from IBM forever.

dizlexic 1y ago
From what I've seen in my industry? To pass all the liability to Microsoft. "If something happens, we used enterprise grade industry standard software. We did our due diligence." This outlook is basically why we can't innovate anymore. I had to recently sit through a meeting where our CTO quoted all the "blogs" he's been reading as a way to slap down my suggestion for an in-house project. It's all about CYA.
- pphysch 1y ago
  Surely there's an untapped market for infosec liability insurance. Pay the CYA bill, let the engineers build/choose something that actually works. Win-win.
- phil21 1y ago
  I call it the liabilty fairy. It's why school boards don't do anything useful, among many many other things in our society. It's an endemic disease. Most of the time it's extremely exaggerated, but it's trotted out and used as a CYA excuse almost immediately by most in the executive/managerial class. Both due to outright laziness and incompetence, and also as just a... why take any personal risk whatsoever making actual decisions with any impact if I can keep my cushy job and career rolling by being as milquetoast as possible. Never mind you get the big bucks to make such important and controversial decisions at great personal (career) risk when some inevitably go wrong. Everyone forgot that part. Such roles should be hard, difficult, and risky.
1y ago

hulitu 1y ago

> I wonder if this will incentivize the countries to move faster with Linux. Countries are run by politicians. The ability of a politician to remember something is inverse proportional to the sum of money landed in its account.

formerly_proven 1y ago

As far as I can tell there's two vulnerabilities bundled up here. One is an unauthenticated command injection (!) vulnerability to steal some keys and the other is of course yet another serialization-based RCE in a safe language, mediated by signed cookies (signed with the keys stolen in step 1). I don't understand how often this design has to blow up in people's faces until they stop doing this and use something dumb and safe instead.

vpShane 1y ago

> I wonder if this will incentivize the countries to move faster with Linux. I hope so. We're seeing it now though. Germany, Norway. Not saying there won't be CVEs when they move, but at least there's freedom and openness already available to switch to.