Hacker News Reader

Comment by remote_phone | Hacker News Reader

If this is true, Microsoft should be completely embarrassed and the leads on this piece of softwar who made that decision, all the at up through to senior management, should be fired.

For Microsoft to build such a product without basic security in mind is beyond belief in 2020. There is no level of “technical debt” excuse that can make up for a lazy, anti—user decision like this.

View on HN

That’s a stretch. If we fired everyone every time something like this happened, you would have nobody working in tech. This bug does not result in data leakage/disclosure, nor it put anyone’s business at significant risk. Lesson learned, let them fix it, and see what we can learn.

This is an enterprise product. Enterprise customers are expecting at least decent security. How long has this been out? My son’s therapist uses Teams because she said it had better security.

This is 2020. Microsoft is 40 years old. How many times should we repeats the same dumb mistakes over and over again until we collectively learn as an industry. This should have been stopped at the initial design phase. Clearly those in charge can’t make simple design decisions or haven’t learned from decades of mistakes.

Also migrating from client side to server side means an entirely new version of APIs. It means clients being broken and migration issues for customers. New servers with old clients means backwards compatibility, etc. It will take years unless Microsoft kills the old version aggressively which they won’t because they’re Microsoft. This is a problem that will live on for 5 years at least.

How is this a security risk for your therapist?

This isn't a security issue. Teams policies are basically “please don't talk in the $FOO channel, it's for $FOO messages only”; the actual access is done through Sharepoint. (Though make sure you're not using Channels for security; it's trivial to get into all the Channels in a Team once you have access to the Team.)

Also? Teams is a glorified website running in a (hopefully up-to-date) embedded version of Chrome. If they replace some of the scripts it requests with “redirect to this updated Teams client”, then by golly it'll do that, and server-side API changes won't matter in the slightest.

Reply on news.ycombinator.com