6 ms·

We need more Red Hat and less Microsoft in the on-prem enterprise business. These exploitable vulnerabilities are unacceptable when your customers are the likes

• LoganDark 1y ago
  Could be that Microsoft can navigate all the regulatory bullshit that surrounds anything government. I don't know of anyone doing that for anything Linux.
  • dralley 1y ago
    There's tons of Red Hat in federal IT, that's not the issue. It's just that Microsoft dominates the client-facing software business, and Red Hat has minimal presence there so while you might see RHEL desktops at e.g. NASA you're unlikely to see them anywhere else, and there's no real open source equivalent of SharePoint or Office out there. Maybe [0] will be one, eventually, but it would take a long long time to replicate the functionality if it were to ever happen. Best case scenario is that the EU were to fund an open source solution. [0] https://www.techradar.com/pro/mozilla-launching-thundermail-email-service-to-take-on-gmail-microsoft-365 https://www.techradar.com/pro/mozilla-launching-thundermail-...
    • LoganDark 1y ago
      Huh, I didn't know Red Hat did any government stuff.
    • hollander 1y ago
      > Schleswig-Holstein, one of Germany’s 16 states, on Wednesday confirmed plans to move tens of thousands of systems from Microsoft Windows to Linux. The announcement follows previously established plans to migrate the state government off Microsoft Office in favor of open source LibreOffice. https://arstechnica.com/information-technology/2024/04/german-state-gov-ditching-windows-for-linux-30k-workers-migrating/ https://arstechnica.com/information-technology/2024/04/germa...
      • mike_hearn 1y ago
        People don't take it seriously because European governments have a history of making announcements like this and then rolling it back in favour of a return to Microsoft.
        • calgoo 1y ago
          Lets see what happens when they try to move finance of Excel. If they are successful there, then there might be hope, if not, then they will eventually go back or have 45% of the company on some kind of exception.
• timeon 1y ago
  Not sure how it is in US but where I am, it is mostly because of corruption.
• cube00 1y ago
  > Isn't security the number one priority in those spaces? Money changing hands between suitable people who pop up together at the right social occasions is the priority.
  • conception 1y ago
    This though is also true in the private sector.
    • gottorf 1y ago
      In the private sector, there's a slightly more direct link between job underperformance and being fired.
      • sigmoid10 1y ago
        And if your strategy fails, you (usually) can't raise taxes to make up for lost revenue. So there is an even more direct link between underperformance and losing money.
        • nosianu 1y ago
          I don't get such incomplete, selective, comparisons. The country can't go bankrupt and you just found another one. Yes, when a country messes up they have to actually fix things, there is no way around it. Except getting merged into another country - like my birth country, the GDR, ended up as West Germany's problem (but its people still had to do the work). Also, if big enough companies (and banks) fail, it is the same. Not having a string government would not help either, in such cases the companies would be the government, as we saw in even wilder times of huge companies and much less state in the US some century or two ago. At some point in the hierarchy you have to live with not having omniscience and accept that sometimes things don't work out, and that you can't just walk away from the consequences of those failures.
          • sigmoid10 1y ago
• dboreham 1y ago
  The clients of said server are not going to be Linux. Running a secure, working, manageable CIFS server on Linux serving Windows clients is surely going to cost much more than just using the Microsoft solution. Some products don't even work at all with that configuration (e.g. Quickbooks Enterprise).
• okanat 1y ago
  Microsoft invested in making integrated Windows-based business software and a big closed-source ecosystem and/or bought other tech companies that previously developed similar tech. Some of them older than Red Hat even Microsoft. Where is the equivalent tech on the Linux side that Red Hat developed? They simply didn't have a competitive enough alternative. Usually anything outside of cloud/web server space, you'd find alternative open-source projects rotting with non-clear ownership and year old last commits. Red Hat and Linux world weren't interested in developing those things. They weren't interested in making competitive user friendly alternatives that enabled non-programmer users. It is hard, thankless, soul crushing work that nobody does anymore since Microsoft bought or eliminated them. There are simply no equivalent alternatives in the open source world because competing with Microsoft requires accepting significant losses as a company for a long time. Google Workspace is a thing only because Google can finance its developers with ad money. Just having Linux is no golden key to security either. You need to put the exact amount of barriers in front of your on-prem servers regardless of the OS. The whole security mess is just the symptom of capitalist economy. Most companies give 0 fucks about it because caring about security is costly and time consuming. With the race to the bottom for first-to-market, caring about security is a risk, it is a distraction. They ignore it until they establish a position and maybe their misdeeds become a liability. However, no company got actually severely punished for not caring about security. So it is still seen as cost by many.
  • GabeIsko 1y ago
    Most government IT is using RHEL. You are correct, it is because of the thankless work they put into long term enterprise support. Microsoft doesn't do anything like that.
  • mike_hearn 1y ago
    Red Hat were interested. They funded desktop Linux heavily for a long time. It didn't work because the (non-capitalist!) ideology of Linux is incompatible with success, and Red Hat always tied down by the community they chained themselves to. Desktop platforms have far more hardware and software heterogeneity than server platforms do, the pace of innovation is much faster, and they require the ability to ship closed source software, closed source drivers, to innovate and then for people to capture some of the value to fund all that. For the longest time desktop Linux simply tried to clone Windows/macOS. Eventually Red Hat came to dominate GNOME enough that it developed a bit of its own personality, but the kernel and software distribution approach always held it back from even matching its competitors in usability, which wasn't even close to enough. Apple have executed excellently for decades and even they only made progress in the pure consumer space, the enterprise space is one they never tried to attack despite having the money needed to do so. Capitalism isn't the problem here. Communist software isn't exactly famous for being impenetrable, in fact it's more famous for hardly existing at all. Google and Apple are highly capitalist, and their security stance is much better. The problems at MS are deeper.
• xcrunner529 1y ago
  Did you already forget about log4j?
  • zufallsheld 1y ago
    log4j is a once in a decade event, while vulnerable Microsoft software is more like once a month.
    • tpxl 1y ago
      Log4j is a Java thing divorced from the operating system running it.
      • xcrunner529 1y ago
        This was about open source. Not Linux.
      • anonymars 1y ago
        SharePoint isn't an operating system either
    • xcrunner529 1y ago
      Zero day actively explored events are not a once a month thing. Are you trying to argue there’s no Linux vulnerabilities monthly??
      • zufallsheld 1y ago
        No, as we both know, there are vulnerabilities on Linux, like log4j. And I also did not say that zero days are a once a month thing, I said that vulnerable Microsoft software is a once a month thing.
        • xcrunner529 1y ago
          There are monthly security updates for packages for our Linux systems too.
• GabeIsko 1y ago
  I can assure you, the DoD isn't a bunch of windows servers hosting sharepoint for the public. Federal government IT in general is a RHEL shop, at least serverside.
• kuhsaft 1y ago
  Most enterprise PCs are Windows machines and integrate with Microsoft services easily. The only way Microsoft is going to lose the enterprise market is if enterprise PCs move away from Windows. But, for enterprises, the only reasonable migration away from Windows is Mac. JAMF Pro for Mac can be hosted on-premise on Linux. The majority of enterprise software runs on Mac. However, Macs are expensive so it's unlikely to overtake Windows enterprise machine usage. Hardware support for Linux PCs is poor and lacks the manageable of Windows PCs with Active Directory and GPO, or JAMF for Macs. Enterprise software usually doesn't support Linux. Linux PCs are uncommon for personal use and corporations don't want to train users how to use Linux.
  • sherr 1y ago
    "Hardware support for Linux PCs is poor and lacks the manageable of Windows PCs with Active Directory and GPO, or JAMF for Macs. Enterprise software usually doesn't support Linux. Linux PCs are uncommon for personal use and corporations don't want to train users how to use Linux." I would dispute the "hardware support" comment. Linux has pretty good hardware support nowadays. And "enterprise" software is a vague term here. For desktop Windows, of course Microsoft will have that covered every which way, but for things such as authentication, authorization and security, Linux has a place. A comment about adding "Redhat" to the mix is not talking about desktops (necessarily) but servers and security.
    • rahkiin 1y ago
      There are still plenty of issues with bluetooth, batteries, microphones, gpus, touchpads etc when doing a clean install of Ubuntu on any random laptop.
      • deleted 1y ago
        [deleted]
      • hollander 1y ago
        Enterprise and government don't use random laptops.
      • 1y ago
• resonious 1y ago
  I do wonder if the fact that these vulnerabilities get exploited so often is because the customers are the likes of DoD. If DoD used Red Hat, maybe we'd see more large-scale linux/freedesktop exploits being discovered.
  • bartread 1y ago
    I think there's certainly an element of tall poppy syndrome here. Windows, for example, used to be targeted because its security was a complete joke until quite late in the XP era (SP3 IIRC). But there's always been, and still is, and element that it's targeted because it's a big, juicy target. A huge portion of the desktop and server market are running Windows. It used to be almost all Windows, at least on the desktop. Nowadays mobile computing has become far more important so Windows doesn't have the end user dominance it once did, but there are still a huge portion of end user devices running Windows. Same on the back end: it's just a big juicy target, and the bang for buck that hackers get from it is huge given how prevalent it remains in corporate and government environments.
    • dijit 1y ago
      yet nearly all internet facing servers are linux; and we don't see the same volume of issues.
      • hnlmorg 1y ago
        I hate Microsoft products as much as the next person, but I don’t think your statement is entirely fair: SharePoint isn’t Windows. It’s a Microsoft product that’s only available for Windows Server. But it’s not Windows. The reason I make that distinction is because if you widen the scope of services available on Linux then you might come a lot closer to the same volume of issues. For example, take a look at how frequently CVEs are raised against popular CMSs.
        • dijit 1y ago
          Sure, I get the point, a more apt comparison might actually be RedHat though, since they're doing E2E packaging for a product suite. I mean, Linux isn't even Linux - At the risk of invoking a meme: Linux is actually GNU + Linux; and even then there's a web-server on top, and software that it runs. So, a working comparison might be Wikipedia? As far as I understand it; that's the largest CMS on the planet.
• jve 1y ago
  > when more secure (Linux-based) options are far cheaper and widely deployed Hold on, we are talking about SharePoint here. I don't know any software that could replace it, that is allowing office suite to collaborate in a way SharePoint Server does it (versioning, concurrent editing, online editing, workflows, customizations, OneDrive, IRM, compliance, search etc.) Even in a windows environment. Can you name more secure, cheaper and widely deployed alternative?
  • hollander 1y ago
    Google Workspace
    • ryanjshaw 1y ago
      This is SharePoint on-premise, so Google Workspace isn’t a good comparison? Also, even if we do look at cloud: Workspace isn’t bad (exception: sheets vs Excel), but SharePoint is the center of Teams, Power Platform, PowerBI… to replace M365 with Workspace means a lot of research, setup and testing of 3rd party alternatives to the above. If you’ve ever worked in a well configured Microsoft stack, nothing beats the integration. There’s no reason to believe Workspace would be more secure if it had the same feature set/integration configured.
      • quaestio 1y ago
        Sheets is vastly superior to Excel for most users ;)
        • HPsquared 1y ago
          Most users don't produce most of the value.
    • jve 1y ago
      That's actually good point, thank you. However not something that one can install on-premises or is "far cheaper".
• zwnow 1y ago
  > Isn't security the number one priority in those spaces? No. Quick iterations and output output output. Security is one of the least concerns in any company I have ever worked in.
• mschuster91 1y ago
  > Why do Microsoft products enjoy a monopoly on the server in these sectors when more secure (Linux-based) options are far cheaper and widely deployed already? Because there is no FOSS solution even coming close to the level of out-of-the-box integration of Office 365. Thunderbird has zero integration with LibreOffice, LibreOffice has zero integration with Owncloud (or whatever else one might use), neither has integration with a softphone software, much less a backend like Asterisk. And some software like Sharepoint or MS Access doesn't have anything on the FOSS side.
  • prmoustache 1y ago
    OTOH that is a plus for security. When everything is interconnected/integrated, everything is usually pwned at the same time.
    • mschuster91 1y ago
      The problem is, decision-makers will not go for the "secure" way, they want a solution out of "one mold" - and so do users. It is a common complaint when trying to set up a FOSS solution, users complain that they have to learn and memorize different ways of doing the same thing across different application... and made worse by many FOSS projects not having UI/UX designers at all that care about consistency even in the scope of the application itself. And on top of that, many data exchange formats are not just "old", they're "fossil" and don't even come close to meeting the demands that people have come to expect.
      • prmoustache 1y ago
        In the non FOSS world it still ends up the same. In every single company I have been working in the last 15 years, information was spread across so many different tools that integration was a moot point: Office365, Jira, Confluence, a separate ticketing tool, some mkdocs or single markdown files in repositories, spreadsheets, dedicated HR web portal, intranet, internal blog/comm/social media... Even within Office365 information is stored randomly as office files in sharepoint, teams channels, personnal onedrive, emails, copy/paste in teams, teams channel onedrive synched drivees, onenotes...[1] Also RBAC makes sure that whenever you came across one doc containing link to other stuff, you end up having no access to half of the links Bottom line the tightest integration doesn't reduce any friction because there is not a single toolsuite that fits every use case and people end up making a mess of everything. You never know where you can find the information and every single teams wiki ends up being a collection of links to a myriad of different places. Also half of the people still email people documents instead of the links because they don't understand anything else. [1] yes it is in the background the same product but people access them and more importantly know or search the information in totally different ways.
• PeterStuer 1y ago
  "Why do Microsoft products enjoy a monopoly on the server ...?" They don't. There's plenty, even a majority, of non-Windows servers in gov (I know, some depts are true MS shops). Sharepoint is one of those things that snuck in via the desktop. It was touted by MS as an evolution of shared folders with "Intranet" features included. If you already ran a Windows Server for fileshares, Sharepoint was "free". The initial few implementations were of extremely poor quality, even by MS standards, but SP was positioned in the MS channel as the future of MS server side application development. So all of the consultancy/sales channel jumped on the SP wagon for any custom server projects. For developers, it was a nightmare. Underneat the platform was a frankensteinian horror of bits and pieces of resurected code from many departments and projects across MS crudely bolted together with chewing gum scraped of a park bench and bits of string recovered from old fish guts. Lists (SP's core structure for file directories with exposed metadata properties) could not work reliably, the system fell over under even light load, latency was totaly unaceptable even for basic operations, files did not rountrip through the server unchanged ... Over the years MS cut it down from "the future platform for custom backoffice apps" to "out of the box Intranet with mainly cosmetic configuration options" to "cloud hosted office 365 shared folders". " Isn't security the number one priority in those spaces?" No. It's exacly like every other IT environment of comparable size. Security is considered important, but does not drive sales. Features and cost, but also available expertise from the supplier/channel partners dominates the choice. Security is covered by promises and certifications, but more often than not left to operations to patch up.
  • ubermonkey 1y ago
    I was involved in a software startup that was aligned with MSFT 18 or so years ago. We built the web app side of our tool in Sharepoint precisely to be a good team player, and make ourselves more attractive to Redmond, even though it gave us no real benefits. The support problems were INSANE. We ended up spending an entire release cycle pulling the web app out of Sharepoint and just doing a proper stand-alone web site. Support calls plummeted. Sharepoint is something only a marketer could love.
    • ethbr1 1y ago
• benterix 1y ago
  It all started with Novell Netware. It was a great product and companies would buy it to have centralized management. Microsoft noticed this and decided to use their power position to drive Novell out of the market by offering a similar service and have it built in in their server product line. Novell tried to fight but it didn't last long. The protocol was proprietary and an open source implementation in Samba was very slow at catching up. If you decided to host a domain controller using it, you newer knew if a random disconnect was a network issue or the controller or the client. And here we are. Active directory, or Entra or however they call it these days, is basically a standard way to manage users everywhere. And until a strong entity (EU?) comes up with strong backup towards an alternative solutions (we have plenty of them now), the situation will not change.
  • ExoticPearTree 1y ago
    > Active directory, or Entra or however they call it these days, is basically a standard way to manage users everywhere. And until a strong entity (EU?) comes up with strong backup towards an alternative solutions (we have plenty of them now), the situation will not change. You still have Active Directory on premise and now you have EntraID (formerly Azure AD) in the Azure cloud. For Windows devices, it is the only mechanism supported to have a centralized management system. For other systems, such as MacOS, you have alternatives that don't require any centralized user database. Most cloud-native companies today rely on Okta or Amazon Cognito for their applications. Google Workspace supports this too, but it is incredibly basic at what it can do. I don't think there's nothing that anyone can do to make this different. And just to nitpick a little, it's like saying the smartphone reduced the camera market because of its dominant position. It didn't, it just provided convenience when there was none (a phone, a camera, a video recorder...).
• 7bit 1y ago
  Security aside, what even is an alternative to SharePoint on Linux? There is not one.
  • mr_toad 1y ago
    Probably because most Linux users aren’t looking to share (or even use) office documents. Linux collaboration happens on wikis, message boards, and Git.
  • CapricornNoble 1y ago
    There's Liferay: https://www.liferay.com/resources/l/content-management-system https://www.liferay.com/resources/l/content-management-syste... https://hub.docker.com/r/liferay/portal https://hub.docker.com/r/liferay/portal I haven't played with it in about 5 years but it was substantially less polished than a well-run Sharepoint 2013 instance.
• y42 1y ago
  the problem is not Windows' (alleged) insecurity, it's it popularity. if everyone would use red hat, the same thing would happen.
• paganel 1y ago
  > your customers are the likes of DoD. One of the answers should be for the DoD, or any other such military institution, to try and rely a little bit less on everything being "digitilized", or at least to change it all into a more fragmented data/information "archipelago", with no centralised unique source-of-truth.
• icanhasjonas 1y ago
  Only because Microsoft offers “certified professional” badges and the MSCP’s are pushing the only thing they are certified for, and the corporations buy into the whole “certified” thing. I have a ton of customers where the admins are constantly reminding everyone about the certifications they have, all while their basic security is below average. … but they are certified!
• dudeinhawaii 1y ago
  Unpopular opinion but I don't think this solves anything. The exploit wasn't an OS exploit but a userland app exploit (Sharepoint Server/App). These attacks will always be developed until we're able to write perfect exploitation free software. If the government was running Red Hat with 'open source SharePoint alternative' the headline would be 'open source SharePoint on-prem solution exploited'.
• ceejayoz 1y ago
  > No one considers Google anything less than an impenetrable fortress… I think it's deeply likely that most major intelligence agencies have people burrowed into the various FAANG type companies. Like this guy, but less foolish about revealing it. https://www.nbcnews.com/tech/social-media/facebook-investigating-claim-engineer-used-access-stalk-women-n870526 https://www.nbcnews.com/tech/social-media/facebook-investiga...