7 ms·
Microsoft rewarded for security failures with another US Government contract
- datadrivenangel 1y agoToo big to fail sets us all up for failure.
- belter 1y agoMicrosoft is the new Boeing.
- IAmBroom 1y agoBoeing isn't "too big to fail". That was used to describe the big banks at the middle of the Great Recession. Boeing is "the only game in town". All other big-aircraft manufacturers are foreign.
- behringer 1y agosounds like a great reason to break them up
- anonymousiam 1y agoLeave Boeing alone. The way they're going, they'll break themselves up eventually.
- immibis 1y agoAs Boeings tend to do.
- themafia 1y agoBeing the "only game in town" grants them special status as a US defense contractor given that many agencies are required to source their materiel domestically. So, to me, the "too big to fail" set absolutely includes "only game in town." It's really just a special case of it.
- ldayley 1y agoThis headline BADLY buries the lede! The real scary stuff is the massive future costs of the blatant vendor lock-in that ALL the big tech firms, including Microsoft, are banking on with “free to the government for a year, undisclosed terms for later” contracts.
- wkat4242 1y agoThis is kinda the same for big enterprises too. They start off with really great deals, then every other part is "only a cheap addon, much cheaper than competing product XYZ". Then when you're completely stuck in the M365 swamp, that's when they turn the thumbscrews when the contract renegotiation comes up.
- okanat 1y agoThe thing is: Where is the competition though? Considering that most IT departments don't want to spend an extra dime to do consumer-grade software engineering to do any extra integration there is no significant competition to Microsoft 365 and Active Directory. Google Workspace is the closest but it isn't even in the same playing field when comes into advanced integration. Microsoft killed all of its competition in 90s and early 00s. Nobody stopped them. Nobody applied antitrust law. Now they have at least a decade ahead of everybody else. Any competition should have to spend quite a bit extra money to just move all the integrated apps (SAP, Salesforce, CAD software, Exchange extensions) to their environment. To repeat my point, most IT departments want to spend a whole 0 on developing / engineering integrated solutions and developing those require some millions per year at least. Microsoft sells these stuff as low as €20 per user depending on the contract.
- aussiedude 1y agoAmazon tried with its work suite - work mail, work drive and chime but failed miserably. It’s now a Microsoft 365 user
- Sysadminhell 1y agoJust one more massive breach and Satya wins a mountain bike.
- stalfosknight 1y agoWhy must the government and almost every corporation continue to reward Microsoft for their horseshit?
- wtbdbrrr 1y ago[dead]
- prerok 1y agoEmm, they don't, but the price to switching is too high. If everyone in their formative years would use Linux, then it would be a different story. But... they don't, so it requires reeducation. I think Mexico attempted it and I hope they were successful.
- kube-system 1y agoBecause a top-down management structure has advantages in delivery accountability, regulatory alignment, and scoping of risk. A successful software implementation requires a lot more than just software. Tearing out all MS software at any large organization would involve quite a bit of compromise and many opportunities for failure.
- jiggawatts 1y agoDo you think any other large software vendor is pure as the driven snow? Oracle? Google? Broadcom?
- mcphage 1y ago[flagged]
- mattmaroon 1y agoWhich one was?
- mcphage 1y agoCompared to this one? Biden, Obama, W Bush, Clinton, H W Bush, Reagan, Carter, etc, etc.
- mattmaroon 1y agoI can think of lots of unpunished security failures from all of these. This is one of the very few areas in which it seems like business as usual. Executives don’t like to punish their own people because it makes them look bad. They’ll scapegoat people when necessary of course.
- neuroelectron 1y agoAs an A erican Dynamics 365 developer, I wonder if I qualify for these jobs, or is it only spies willing to do it for extremely low pay that get the job? Tbf, My boss charges $165 an hour for my time. Freelancers charge even more, of course.
- chirau 1y agoMaybe it's just me, but I do not get your point. Would you mind clearing it up?
- charcircuit 1y ago>Microsoft rewarded for security failures It was the government's security failure and not Microsoft's. Microsoft was up front about what was happening and the government could have pushed back if they did not approve of the digital escort system.
- SilverElfin 1y agoInstead, the government should fund competition to lower prices. It seems like Office is still the default for everyone and it’s not really possible for anyone to hire thousands of engineers for a decade or two to compete with them. There’s no functioning competition for a product like this.
- mattmaroon 1y agoGoogle, Apple, and various, other open and closed sourced alternatives exist for nearly everything in Office. Many of them have been under development for decades by companies that are similar in magnitude to Microsoft. Lack of competition is definitely a problem in the pricing of some things, but I don’t think this is one of them, people just prefer what Microsoft offers and are willing to pay for it.
- gjsman-1000 1y agoLibreOffice, in the most primordial form, has been developed since 1985. It's older than Linux. To be honest though, would I use it for my business? No. Broken formatting (for either my side or a client's side) isn't acceptable; the UI is two decades behind; LibreOffice Calc is still too incomplete; and who knows what's in a C++ codebase that old and that large (100,000+ files, 10M+ LoC) - it's basically security by obscurity. Microsoft Office getting hacked and fixed, is better than a target too small to matter until a government adopts it.
- kube-system 1y agoI like LibreOffice... but the people who think LibreOffice is even remotely a competitor to Office 365 have no clue what Office 365 does or why enterprises use it.
- kazinator 1y agoMicrosoft is rewarded for security, privacy and reliability failures each time a consumer buys another Windows PC. And, to be fair, so is every other software project with an imperfect track record, that continues to have users, whether FOSS or closed source.
- illusive4080 1y agoYeah I hate Microsoft as much as the next guy but every product has security vulnerabilities. If the product is popular enough, then hackers spend time discovering those vulnerabilities.
- okanat 1y agoI don't use Linux as my primary OS anymore. However the default protections of the Linux desktop is worse than Windows's which is rather sad. For "root" level operations Windows has several layers to protect the system itself. The newer Appx packages are have scoped security protections around them. On Linux, yes you can spend months modifying Flatpaks, or writing SELinux rules or apparmor profiles but nobody does that. The out-of-the-box Linux user distros are quite a bit lacking and it is only a matter of time that malware that steal secrets from home directory to arrive to Linux too.
- c0balt 1y ago> On Linux, yes you can spend months modifying Flatpaks, or writing SELinux rules or apparmor profiles but nobody does that. For what it's worth, RHEL and to some degree Fedora do give you those SELinux rules for most of their packages. That OOB for anything you would install with rpm. > it is only a matter of time that malware that steal secrets from home directory to arrive to Linux too. No need to wait? Most of the malware distributed over npm/pypi has supported Linux and sometimes MacOS for a long time.
- dhx 1y agoWindows has AppContainers which is for the most part a wrapper around the Windows Kernel Mandatory Integrity Level (MIL) feature.[1][2] MIL restricts certain API calls of processes depending on the integrity level of the current process vs. integrity level of a target process for the API call. The idea being a process with a low integrity level wouldn't be able to read or write via IPC to a process with a high integrity level. The process with a high integrity level would instead need to read or write via IPC to the process with a low integrity level.[3] Because there are obvious architectural limitations of having a linear scale of privilege levels which one places all processes on, Windows has tried implementing "Windows Sandbox" as an alternative sandboxing mechanism that executes a process in a Hyper-V virtual machine that has restrictions placed on the interfaces exposed into the virtual machine. I believe Windows Kernel still doesn't have any similar functionality to Linux's namespaces that are much more capable and flexible with sandboxing applications. The reason I recall is Windows' GDI subsystem (painting/drawing) being implemented within the Windows Kernel, not a userspace process as you see with Wayland compositors on Linux systems. This GDI subsystem I believe was the main problem holding back the Windows Kernel from implementing Linux-like namespace and sandboxing functionality. Linux and common desktop environments such as Gnome also offer sandboxing out-of-the-box in more ways than a typical Windows installation, including as examples: - very granular seccomp filters implemented for system processes (typically via the simple and accessible method of systemd service configuration) to only permit a process to make certain syscalls or access only specific system resources (files, network interfaces, etc) - seccomp filters for revoking permissions on processes once they've started up and no longer need certain permissions. See for example OpenSSH and how it forks into less privileged processes once ports have been opened, keyfiles read, etc. - Use of multi-process application architectures where each process is individually sandboxed, where a Windows equivalent would be a monolithic application. See for example use of "glycin" in Gnome applications for parsing and loading images in separate sandboxed processes from other parts of the application[4], or "tracker" again in Gnome applications which sandboxes the processes for metadata extraction from each file. [1] https://learn.microsoft.com/en-us/windows/security/book/application-security-application-isolation https://learn.microsoft.com/en-us/windows/security/book/appl... [2] https://learn.microsoft.com/en-us/windows/apps/windows-app-sdk/migrate-to-windows-app-sdk/feature-mapping-table?source=recommendations https://learn.microsoft.com/en-us/windows/apps/windows-app-s... [3] https://learn.microsoft.com/en-us/previous-versions/dotnet/articles/bb625960(v=msdn.10) https://learn.microsoft.com/en-us/previous-versions/dotnet/a... [4] https://gitlab.gnome.org/GNOME/glycin https://gitlab.gnome.org/GNOME/glycin edit: some references added
- buyucu 1y agoNobody who cares about security uses Microsoft or Windows.
- TheNewsIsHere 1y agoI’ve been chatting with my cofounders about plotting a course out of Microsoft 365 and Azure AD/Entra ID. Current working strategy is to first move everything using Entra SSO to our own hosted IdP, and then everything else. From there we’re thinking we move SharePoint/OneDrive, and replace the Office apps with LibreOffice (maybe Collabora?), and eventually replacing email with Fastmail, which we already resell. We’re a managed hosting firm with a few technologists, and we have no external MS365 collaborators, so we’re a good fit for that kind of setup.
- aussiedude 1y agoWhich iDP are you thinking? Also how’s fastmail with calendar invites to companies on exchange? What would you use to replace teams? Zoom?
- TheNewsIsHere 1y agoKeycloak, most likely. We have experience with it. Fastmail’s calendar invitation support is solid in my experience. And they support access via standard protocols. That is very quickly disappearing with Microsoft 365. We never used Teams. Once we had the option to switch to non-Teams 365 licenses we did that almost immediately. We used to use Slack, but saw the writing on the wall when Salesforce acquired it, moved to Mattermost in Kubernetes, then Mattermost Cloud’s paid tier when it launched. When Mattermost evicted non-enterprise licenses from their cloud service we never replaced it. Turns out, we don’t really need an internal chat/conferencing app. We’re a few guys within a half hour of each other. If we need to, we hop on a call, send an email, or send a text to schedule a in-person meeting.