3 ms·
I have to give Microsoft props here. Most companies don't bother to lock things down well enough, but they were thorough.
by 0xbadcafebee 1y ago
I have to give Microsoft props here. Most companies don't bother to lock things down well enough, but they were thorough.
- stogot 1y agoI would give the one engineer the credit for doing things better, not Microsoft. Microsoft overall culture of security is terrible. Look at the CISA report.
- kenjackson 1y agoWhat CISA report?
- aspenmayer 1y agoI’m guessing they mean this one: https://www.cisa.gov/news-events/bulletins/sb25-167 https://www.cisa.gov/news-events/bulletins/sb25-167 > Microsoft--Microsoft 365 Copilot > Description Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. > Published 2025-06-11 > CVSS Score 9.3 > Source Info CVE-2025-32711 https://www.cve.org/CVERecord?id=CVE-2025-32711 https://www.cve.org/CVERecord?id=CVE-2025-32711 And maybe they are referring to this engineer from the linked advisory notes? https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... > Acknowledgements > Arantes (@es7evam on X) with Microsoft Aim Labs (Part of Aim Security)
- NemosDemos 1y agoNot OP, but guessing they were referencing this one: https://www.cisa.gov/resources-tools/resources/CSRB-Review-Summer-2023-MEO-Intrusion https://www.cisa.gov/resources-tools/resources/CSRB-Review-S...
- stogot 1y agoThis one: https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewOfTheSummer2023MEOIntrusion508.pdf https://www.cisa.gov/sites/default/files/2025-03/CSRBReviewO...
- homarp 1y agohttps://news.ycombinator.com/item?id=39922066 https://news.ycombinator.com/item?id=39922066
- bigfatkitten 1y agoMicrosoft has islands of security excellence in what these days is a sea of mediocrity.
- deleted 1y ago[deleted]
- 0xbadcafebee 1y agoOkay, so I give the team that put this together credit. Hopefully the parent company sees based on this that it's worth letting teams invest more in quality and security work, over features.
- dudeinjapan 1y agoWe should give all the credit to the Product Manager because he told the engineers to make it secure.
- chrz 1y agoLets send a thank you letter to Bill Gates
- dudeinjapan 1y agoI presume you mean Bill Gates Sr. because he fathered Bill Gates.
- deleted 1y ago[deleted]
- deleted 1y ago[deleted]
- bravesoul2 1y agoI bet the container was in an isolated VM too.
- selfmodruntime 1y agoEvery infra I ever worked in used this pattern to a degree. Many proxmox vm's in a kubernetes cluster.
- silverliver 1y agoI've seen people manually create a separate unprivileged user on the host for each VM they run, so for them the pattern becomes: 1. VM running on hypervisor as unprivileged host user 2. Container running in VM as unprivileged vm user 3. Payload running in container as unprivileged container user. Not sure whether layered isolation is worth the increased attack surface. For normal users (not targets of state actors), it probably is.