4 ms·

> at the same time say "security is our top priority". I don't think that's true anymore, and this proves it. They did the security song and dance for a while

> at the same time say "security is our top priority". I don't think that's true anymore, and this proves it. They did the security song and dance for a while because they were under pressure. Now AI is the number one priority over everything else, security be damned.

bigfatkitten 1y ago
The security focus mostly ended when Nadella got the top job, well before the AI craze.
- embedding-shape 1y ago
  I remember Bill Gates (sometime around 2000-2005 maybe?) saying "Security is now the top priority for Microsoft", and in 2024 Satya Nadella said it again (https://www.cybersecuritydive.com/news/microsoft-ceo-security-priority/714450/ https://www.cybersecuritydive.com/news/microsoft-ceo-securit...) and just one month ago, a blog post titled "How Microsoft is creating a security-first culture that lasts" (https://www.microsoft.com/en-us/security/blog/2025/10/13/building-a-lasting-security-culture-at-microsoft/ https://www.microsoft.com/en-us/security/blog/2025/10/13/bui...) I don't think it ever ended, nor that it ever started. But they've been saying this for a while not, for at least two CEOs.
  - bigfatkitten 1y ago
    Security came onto Nadella’s radar in 2024 because Microsoft was compromised quite thoroughly (and avoidably) by the Russian intelligence services that year. https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/ https://www.microsoft.com/en-us/security/blog/2024/01/25/mid... Midnight Blizzard was the turning point after a decade of neglect, that saw a lot of amazing work done by some very talented people during the Trustworthy Computing era (following the Gates memo) being unwound.
    - embedding-shape 1y ago
      Yes, I'm aware of that, but I'm telling you "Security is Microsoft's #1 priority" isn't a novel thing Nadella came up with, Bill Gates been saying that many times too. Gates in 2002: https://www.sfgate.com/business/article/Gates-makes-security-a-top-priority-2881922.php https://www.sfgate.com/business/article/Gates-makes-security... (which mentioned Gates also said to focus on security in 1995 as internet became a new vector) Gates in 2016: https://www.cnet.com/tech/tech-industry/gates-security-is-top-priority/ https://www.cnet.com/tech/tech-industry/gates-security-is-to... Just two examples. I think saying "Security is the most important!" is part of the job description of a Microsoft CEO, since they keep repeating it, yet security keeps being a low priority.
      - bigfatkitten 1y ago
        The difference in 2002 is that Gates actually meant it, I know this because I got to see it first hand. Windows XP SP3 was all about security. Vista introduced massive improvements with things like UAC, ASLR, Bitlocker, secure boot and add-ons like EMET that eventually got rolled into Windows itself. At the same time, there were massive changes in the engineering culture in terms of the secure development lifecycle. A lot of other, arguably sexier feature work took a back seat to get all of these things across the line.
  - kjs3 1y ago
    I remember asking Steve Balmer somewhat before this (late 90s?) "will Microsoft ever prioritize security over new features?". He looked at me like I'd kicked his puppy and said "we would never do that". Culture comes from the top and all that...
IT4MD 1y ago
[dead]
einsteinx2 1y ago
I don’t think security has ever been Microsoft’s top priority.
- rchaud 1y ago
  Before Windows Defender, people were paying small fortunes for anti virus and malware scanner software.
  - sunaookami 1y ago
    Because there was enough propaganda to make people believe they need kernel-level malware to "combat" real malware.
array_key_first 1y ago
I mean, has security been Microsoft's, and specifically Windows', priority... like, ever? They pretty much half-ass it every chance they get, just slapping some popup or something, training their users to completely disregard whatever Windows warns them about.
- thewebguyd 1y ago
  There’s quite a bit of security related features they baked into Windows. Virtualization based security with code integrity, app guard, device guard credential guard, etc. are all really robust, but it all requires configuration, and some is locked behind enterprise licensing. The entire NT security model is built on security descriptors applied to pretty much every system object and is way more granular than *nix’s User and Group ID access control. So yeah, for a while at least, Microsoft did prioritize security and did a lot of work to harden windows (or rather, provide the features for corporate IT departments to harden it). The problem is much of it is off by default, or even not available at all, to home users. Given Microsoft’s attitude and locking this stuff behind enterprise licenses, it’s clear they don’t even view windows as a consumer OS but one that’s designed to be managed at scale by someone else.

bigfatkitten 1y ago

The security focus mostly ended when Nadella got the top job, well before the AI craze.

embedding-shape 1y ago
I remember Bill Gates (sometime around 2000-2005 maybe?) saying "Security is now the top priority for Microsoft", and in 2024 Satya Nadella said it again (https://www.cybersecuritydive.com/news/microsoft-ceo-security-priority/714450/ https://www.cybersecuritydive.com/news/microsoft-ceo-securit...) and just one month ago, a blog post titled "How Microsoft is creating a security-first culture that lasts" (https://www.microsoft.com/en-us/security/blog/2025/10/13/building-a-lasting-security-culture-at-microsoft/ https://www.microsoft.com/en-us/security/blog/2025/10/13/bui...) I don't think it ever ended, nor that it ever started. But they've been saying this for a while not, for at least two CEOs.
- bigfatkitten 1y ago
  Security came onto Nadella’s radar in 2024 because Microsoft was compromised quite thoroughly (and avoidably) by the Russian intelligence services that year. https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/ https://www.microsoft.com/en-us/security/blog/2024/01/25/mid... Midnight Blizzard was the turning point after a decade of neglect, that saw a lot of amazing work done by some very talented people during the Trustworthy Computing era (following the Gates memo) being unwound.
  - embedding-shape 1y ago
    Yes, I'm aware of that, but I'm telling you "Security is Microsoft's #1 priority" isn't a novel thing Nadella came up with, Bill Gates been saying that many times too. Gates in 2002: https://www.sfgate.com/business/article/Gates-makes-security-a-top-priority-2881922.php https://www.sfgate.com/business/article/Gates-makes-security... (which mentioned Gates also said to focus on security in 1995 as internet became a new vector) Gates in 2016: https://www.cnet.com/tech/tech-industry/gates-security-is-top-priority/ https://www.cnet.com/tech/tech-industry/gates-security-is-to... Just two examples. I think saying "Security is the most important!" is part of the job description of a Microsoft CEO, since they keep repeating it, yet security keeps being a low priority.
    - bigfatkitten 1y ago
      The difference in 2002 is that Gates actually meant it, I know this because I got to see it first hand. Windows XP SP3 was all about security. Vista introduced massive improvements with things like UAC, ASLR, Bitlocker, secure boot and add-ons like EMET that eventually got rolled into Windows itself. At the same time, there were massive changes in the engineering culture in terms of the secure development lifecycle. A lot of other, arguably sexier feature work took a back seat to get all of these things across the line.
- kjs3 1y ago
  I remember asking Steve Balmer somewhat before this (late 90s?) "will Microsoft ever prioritize security over new features?". He looked at me like I'd kicked his puppy and said "we would never do that". Culture comes from the top and all that...

IT4MD 1y ago

[dead]

einsteinx2 1y ago

I don’t think security has ever been Microsoft’s top priority.

rchaud 1y ago
Before Windows Defender, people were paying small fortunes for anti virus and malware scanner software.
- sunaookami 1y ago
  Because there was enough propaganda to make people believe they need kernel-level malware to "combat" real malware.

array_key_first 1y ago

I mean, has security been Microsoft's, and specifically Windows', priority... like, ever? They pretty much half-ass it every chance they get, just slapping some popup or something, training their users to completely disregard whatever Windows warns them about.

thewebguyd 1y ago
There’s quite a bit of security related features they baked into Windows. Virtualization based security with code integrity, app guard, device guard credential guard, etc. are all really robust, but it all requires configuration, and some is locked behind enterprise licensing. The entire NT security model is built on security descriptors applied to pretty much every system object and is way more granular than *nix’s User and Group ID access control. So yeah, for a while at least, Microsoft did prioritize security and did a lot of work to harden windows (or rather, provide the features for corporate IT departments to harden it). The problem is much of it is off by default, or even not available at all, to home users. Given Microsoft’s attitude and locking this stuff behind enterprise licenses, it’s clear they don’t even view windows as a consumer OS but one that’s designed to be managed at scale by someone else.