SolarWinds hackers were able to access Microsoft source code | Hacker News Reader

SolarWinds hackers were able to access Microsoft source code

msrc-blog.microsoft.com

676 pointsaccountinhn384 comments

I predict a rash of eventual FireEye, Cisco, and other vendor zero days in the near to mid future. If you are a nation state actor what better way to find zero days then to get the source code and find the bugs to exploit. This is the only thing that makes sense that would be worth the risk of attacking companies such as FireEye and Microsoft.

This is pretty silly. Source code for Cisco and Microsoft products has been circulating since the dawn of the Internet. Meanwhile, Microsoft has some of the most meticulously reverse engineered code on the planet. People who want to illicitly mint zero days out of Microsoft products already have the tools to do so.

And therefore, the "rash of exploits" has already happened and is still ongoing. I think it's just so inconvenient/scary to most people to understand how much is hacked/hackable that they refuse to believe it.

In my opinion the smooth operation of our infrastructure relies less on its security as it does on the discretion of the hackers that have already compromised it.

Another bad thing would be if they got access to the build machines and to the certificates management systems...

I don't think it's silly. Having access to high-level source code beats combing through disassembler output.

Disclaimer: am Microsoft employee.

tplacek's point isn't that source is worse than disassembler output, it's that governments already have and have had access to source for a while (by design as Microsoft does provide source access to many customers, partners, etc). The tooling to dissemble built versions and craft exploits has also existed for a long while.

If source access enabled a rash of zero days, that point in time would have come long in the past.

How long has Microsoft been giving source code to China officially? I know they made that a public stipulation.

Not that alternative means were likely employed for a number of years before that.

This is a genuine question (and a very tangential one that will hopefully not generate discontent): Has Microsoft ever explored the idea of open sourcing Windows? I don't know much about the propritary side of software but it seems like Microsoft has been pivoting toward SaaS, Azure, etc and with the inclusion of WSL it seems like Microsoft is less concerned about competition from other OS's in the traditional sense, or am I grossly underestimating how much licensing Windows earns Microsoft. Not advocating, I am just curious.

You're only reading half of my comment. The other half points out that people who don't care about the law have had access to high-level Microsoft source code for as long as there has been an Internet. Microsoft's trees circulate just like everyone else's.

Companies like Microsoft and Cisco have made their source code available to governments for years, for whatever that is worth. The US government has full access to all the MS source code.

Does this include access to thinks like the Azure Control Plane components? In my mind, that code has a different exposure.

Why would this actually be true? If it’s easier to find in source, Microsoft probably would have found it. Ever single feature there goes through multiple security reviews and there is tons of code linting. All the penetration testers I have met don’t even bother looking at source. They just start trying things they think will flummox the software.

>They just start trying things they think will flummox the software.

This works...until you go against a target that's heard of fuzzing before and has the time and money to do it to their own code.

The really interesting Windows exploits require a combination of "throwing stuff that will flummox the software" and a deep level understanding of structures hidden to the average developer. Look at Yardin Shafir's really wonderful blog post about developing a kernel bug to a PoC - there's a lot of moving parts and security checks in modern windows, and having the source is a HUGE help.

Yardin Shafir's excellent blog post started with a bug found purely through fuzzing by an MS employee security researcher.

I tried Googling to find this blog post. Did you mean to write Yarden Shafir? If yes, maybe it was this blog post? https://windows-internals.com/printdemon-cve-2020-1048/

I also found another hint about their findings in this PDF written by Yarden's co-researcher Alex Ionescu: https://www.usenix.org/system/files/woot20_slides_ionescu.pd.... One of the slides specifically mentions the use of fuzzing tools to find these issues.

If there are other, better links I don't know about, please kindly share. :)

Forgot to check for replies. In particular, I was thinking of this blog post: https://windows-internals.com/exploiting-a-simple-vulnerabil... Thanks for the correction, sorry I typoed her name.

Here's a tweet from the original finder: https://twitter.com/gabe_k/status/1330966182543777792?s=20

Yarden & Ionescu's work are both really top notch. Also anything by Google Project Zero if you want to do a deep dive on the subject.

> If it’s easier to find in source, Microsoft probably would have found it.

Umm sir, have you somehow missed seeing the quality of Microsoft products in the last few decades.

the only interesting part of this whole debacle in my mind is that it highlights what was already fairly obvious. the security of a given environment is only as secure as its weakest link. the entire supply chain for every bit of code that is installed on a machine is a potential vector. if that code happens to run at privilege (like administration software) that vector is shorter. (and that's only if you're considering software) when you think about it, it's staggering.

i suspect we'll be seeing a lot more attention on reproducible and cryptographically secure build environments, similar to the gitian stuff in bitcoin land.

> the only interesting part of this whole debacle... security [...] is only as secure as its weakest link

I agree that it is a staggering debacle; I disagree that the weakest link is the only point of interest.

SolarWinds did not vet its build process and outputs; no antivirus, no government entity, no so-called intelligence agency, no mighty software corporation caught the compromise... for more than six months.

The set of characteristics of this compromise is notable and there are many sobering conclusions.

Also mentioned in this other, brief HN discussion.

https://news.ycombinator.com/item?id=25580673

> This means we do not rely on the secrecy of source code for the security of products, and our threat models assume that attackers have knowledge of source code. So viewing source code isn’t tied to elevation of risk

I don't know how much of this is true. Wouldn't it be helpful for bad actors to understand how Windows defenses work looking at the code thereby increasing the risk?

It is generally accepted in the security community that hiding source code does not provide security.

The principles for developing secure software were identified in the 1970s by Saltzer and Schroeder, and they're still true today. One of those principles is "open design", that is, don't depend on design secrecy for security of the system. Instead, depend on secrecy of things that are trivially changed (like private keys and passwords). Then, when the secret is exposed (or you think it might be), you quickly change all the secrets and there's no problem. One source of this paper: https://www.cs.virginia.edu/~evans/cs551/saltzer/

In the case of Windows, the source code is not really secret anyway. Most governments have continuous access to the source code, typically through the Microsoft Government Support Program (GSP) https://www.microsoft.com/en-us/securityengineering/gsp Many businesses and universities also have access to Windows source code. You can see various programs to provide such access in different cases via https://www.microsoft.com/en-us/sharedsource/ In addition, Microsoft employs a huge number of employees who have access to its source code, and you can't really keep a secret long when a large number of people know the secret. Efforts like bribes, appeals to patriotism, etc. will eventually successfully get someone to reveal a secret if there's a large enough group, especially since it's relatively easy to identify who works for Microsoft or otherwise might have such access.

If that's not enough, Microsoft distributes executables, and disassembers & decompilers can provide enough information for static analysis anyway. So you could re-derive what you need to attack Windows if you needed the source code for some reason.

Anyone who depends on secrecy of code to provide security is in trouble. Typically the real reason to keep (some) code secret is to support certain proprietary business models and to meet certain legal obligations, and are not really about security.

Note that Microsoft understands this; they're quite clear in stating that the security of Windows does not depend on keeping its source code a secret.

It's not just governments - if you give them enough money they'll send you the source, and all the tools required to build it. Device manufacturers in particular need this - you think SeaGate is using the online windows docs when they write SSD drivers?

Yes. /s

(The point is correct, but SSDs are probably a bad example: it is very standardised whether it is in consumer or enterprise space. Maybe nVidia and AMD with regards to graphics card would be a better example?)

To expound on the disassembly, the debug symbols are not just easily accessible but also actively used in Windows app development.

Isn't that the Kerckhoffs's principle? https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

Open design is basically a generalization of Kerckhoffs's principle.

Kerckhoffs's principle is usually stated as "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge." Note that Kerckhoffs's principle only refers to cryptosystems. The open design principle is a generalization that applies to all systems, whether or not they are cryptosystems.

> It is generally accepted in the security community that hiding source code does not provide security

Yes. But with not enough eyes carefully reviewing the code security vulnerabilities will remain also in open source code. And once a bad actor finds it it will be easier to implement an exploit.

It's not opening the source that makes the software more secure. It's enough reviewers or white hats looking at the code. Security vulnerabilities in Linux (both kernel and user space) show that regularly.

Of course with closed source your external reviewers are zero, so that's not the solution.

"It's not opening the source that makes the software more secure. It's enough reviewers or white hats looking at the code. Security vulnerabilities in Linux (both kernel and user space) show that regularly."

Thank you for that additional point, it's worth being said and helps us model the closed source alternative.

Good points, sounds reasonable and plausible

Microsoft shares source code with lots of partners. It would be asinine to admit that source code leaks, accidental or otherwise, would compromise their security. If they did that, it would create headaches for their massive contracts where source sharing is a prerequisite. So they toe the party line and say no, in fact, source code leaks do not compromise security.

Many years ago when I worked at Microsoft I asked for the source code to Solitaire. A few days later I received a stack of CD-ROMs with the entire source code of Windows NT (4.0 maybe).

And what of the source code to Solitaire!?

Cool memory, thanks for sharing.

I just thought of something. At the time blank CD-R's were about $15 each and the fastest burners at the time were 2x burners. I'm sorry I wasted so much of time the person who burned these and the cost of the media!

It took ages to figure out where the code even was in the many files and folders. The directory structure did not make it obvious.

Can't wait until cozy bear leaks that :D

NT 4 code was already leaked almost full back in 2004. You can still find it with relative ease if you know where to look, or search for certain keywords in the code.

Make that winning animation use the GPU!

That was before Source Depot, I presume.

They were using SLM (Slime) but I did not have access to the server since I was on a different project (Microsoft Systems Management Server).

> a stack of CD-ROMs with the entire source code of Windows NT

That's a lot of code. Scary.

>That's a lot of code.

It's estimated to be around 40 million lines of code

And it was not compressed it was just a bunch of files and folders. My guess is it was around 15 CD-ROMs

The source code is already out there, so any compromises have already been found and exploited. Leaking it further won't create more vulnerabilities, and more likely will cause existing vulnerabilities to be found by white hats

> Microsoft shares source code with lots of partners

ALL source code for ALL active AND inactive projects? I highly doubt it.

You simply have no idea if the attackers had access to unshared, proprietary code or not. Like Azure server-side components.

I'd imagine the answer is yes, viewing the source code would increase the risk relative to an attacker that did not have access to the source code, but the statement is saying that whatever risk assessment Microsoft does already assumes attackers have knowledge of source code. EG, they are conservative and do not rely on source code secrecy when making any security evaluations.

That assumes total security competence at Microsoft. The Linux model benefits from public audit.

For what it's worth I'm familiar with Microsoft's security team (both for their infrastructure and code) first hand and they are some of the most competent individuals I've ever had the pleasure to know.

I'm personally not a huge fan of Windows, and it definitely has flaws but the amount of considerations taken into account, and the speed with which issues are identified and repaired in a code base of that size, especially while maintaining a disgusting amount of backwards compatibility is crazy impressive.

That aside, having access to the source code does make finding issues easier. It sounds like that knowledge is assumed in their risk assessments which would make that a fair statement.

How about their bug tracking software, MS equivalent to Jira issue tracker (I assume they aren't using an outside product).

Do we know if they had access to their issue tracker? That would make it far easier to make zero-day exploits faster.

Raymond chen posted about that https://devblogs.microsoft.com/oldnewthing/20200317-00/?p=10...

This puts them on the same level of Linux - when doing Linux threat assessment we can count the attacker has the source code for everything.

In any case, it's silly to think otherwise. It's always safer to assume everyone that we wouldn't want to know something already knows that, whatever it is.

It's the same assessment level but may or may not be the same exposure level.

While Microsoft does not assume that attackers haven't seen the source code, we cannot say how many people who are capable of spotting security issues have reviewed the code.

That being said, it's worth also saying it's a hard comparison to make overall; it's possible there are important parts of the Linux code base that have in fact had less eyes on them than Microsoft has had on theirs; without numbers it's hard to be certain.

Whether or not it would be helpful to attackers, this is still the correct threat model for Microsoft to operate with. Sufficiently motivated attackers can reverse anything they distribute publicly anyway.

Nobody seems to mention an important aspect: megacorps like Microsoft, Amazon, Google or Oracle hire thousands of engineers each year. It's not particularly hard for a bad actor to get an agent hired into their target and gain access, for nefarious purposes, in the legit way.

Yes, but on the other hand, all the Linux source code is publicly available, and it's still considered secure.

No, it is not, by any stretch of the imagination, by security researchers.

This has been on the front page all day: https://madaidans-insecurities.github.io/guides/linux-harden...

It is safe to assume it is more PRIVATE than a Microsoft OS, but not more secure.

Please don't react emotionally to this... It was a bit jarring of a shift in thought to me as well, at first.

Downvoters, consider reading first: https://madaidans-insecurities.github.io/linux.html

windows sandboxing btw. is barely at use. every program can basically read everything in user profiles, that is imo the same on linux.

only windows applications that do not run in full trust mode, like store apps won't do that. and even without store apps you can use something like msix or app-v to package your apps in a "small" sandbox, but you can breakout from the sandbox via runFullTrust

Regardless of what mitigations Windows has in place, when you run closed source programs, without competent security auditing you never know what it's doing. Once you click run your precious user files are always in jeopardy. Even with GUI isolation, a point of contention in the article, it's trivial with a few bytes of code to implement some other form of keylogging which the user will run without much thought because hey, it's Windows, it's "secure" while having no real idea what the program is doing in the background. To reiterate, any execution of closed programs will result in execution of closed processes.

With the Windows model, you don't check your guests at the door. You can't search all guests so you assume all guests are hostile and with it you're always taxed with playing security theater which can not only be expensive in terms of hardware resources but mental resources as well as losing more control over your own environment. Because you let unaudited people in your home, before long you have to lock down most parts of it, even from yourself. In gaining control you've lost control because you don't control for openness in the first place. For the few binaries I run on Linux I sandbox them in a VM anyway. But different models, different hosts, each has their weaknesses.

Most importantly, how do you check the binary you are running is actually built from the source code the vendor says it is if the source is not open ?

They might sincerely thing so, not knowing they were targeted and now all the binaries they ship are also containing a payload added by the attacker.

With open source software and especially the Linux distro model where one set of people writes the software and another buikds it from source and integrates it is much harder if not impossible to pull off such an attack affecting all users of a piece of software.

That article is comes from an extremely naive security posture.

I'm curious whether somebody will challenge it

Linux isn't any more secure or safer than a lock on my door will prevent someone from just breaking the window. Hackers do in fact target linux machines, just not average desktop users. They typically go after servers since they run basically everything. And chances are, standard linux users know what they're doing so a ransomware attack isn't really much to frighten a linux user as much as it is to just piss them off but still recover in like 24 hours or less.

Causation vs. correlation, Linux is secure because it _is_ open source. Closed systems can cut corners, assuming the source stays secret

windows source code has been open to academics for something like two decades

Yeah, the whole point of looking through the source code is to find undocumented APIs and bugs to exploit.

A lot of times stuff like undocumented APIs and bugs are easier to find taking apart the binary anyway. Goofy stuff tends to be obfuscated in source as engineers add so much abstraction around the goofy pieces, but it's clear in the final binary.

> A lot of times stuff like undocumented APIs and bugs are easier to find taking apart the binary anyway.

Is that why Microsoft, and all you people who poke at its binaries, have fixed all the bugs in MS binaries? /s

Why do you think the people poking around MS's binaries overwhelmingly want the bugs they find to be fixed?

The point was that if it was so easy, a lot more people would be disclosing the bugs and asking MS to fix. Not everyone hacker has a malicious intent.

there are many books written on Windows undocumented APIs. these things aren't hidden at all.

Yeah, right. Everything is so open about all MS binaries that they don't even need to be closed source! It takes a lot of time and effort to find these poking the binaries, and then experimenting them. The source code makes this task obviously easy.

Remember that anyone can manually decompile Microsoft source code. It's a lengthy tedious process, but that's nothing for a determined attacker.

That’s not nearly comparable to commented source code repo. “Decompiling” leaves you with a barely readable facsimile of the original code, and most likely won’t even compile again.

The true value in source code at this level are the comments and symbols. Microsoft provides most ofthe symbols, the comments you can’t recover from a binary.

Agreed. They’re using that argument to frame their breach as a win. The reality is that open source is easier to reverse engineer and find vulnerabilities in because you have the source. Our researchers do this every day and closed source makes that harder. Advocacy debates in favor of open source have muddied this conversation - but that is the cold hard reality.

Now that an adversary has MS’s source code, it is indeed easier for them to do vulnerability research. So this is a net loss for MSs overall security posture, not a win.

Practically speaking, being a bad guy with access to Microsoft source code for a short time has very little impact or real-world relevance. They do thousands of updates a day, the build processes are lengthy and poorly documented, the overall direction of the code is subject to myriad political groups inside the company, and they're making massive improvements in multiple branches that will render that snapshot irrelevant within minutes.

The "best" market for any such code would be... what... China? Other than the possibility of figuring out potential hacks who could make use of the code in in its sheer mass? By the time you figure out something clever your version of the code is hopelessly out of date.

Vulnerabilities have lurked for years and even decades in the Windows codebase. I'd not be so certain that having a snapshot today wouldn't help you find exploits for a long time.

Yea, how long was OpenSSL’s heartbleed an issue? And that was open source that was supposed to have millions of eyeballs on it. I agree, I don’t really buy that MS rewriting everything hourly and there is nothing to get from source.

There are lots of updates to the Linux source code yet there's still quite a bit based on work done in the 80s

Very curious as to the details they aren't releasing.

If you read between the lines they are saying that accounts were compromised, but not through token stealing, which means the attackers got the passwords to the accounts, and likely skirted MFA requirements because they were already inside, or there were none.

While there are many avenues to steal passwords once you have the foothold the attackers did, it would be interesting to know the details as to how these particular accounts were compromised.

With a large and sophisticated Corp like Microsoft, wouldn’t they have a Zero Trust kind of security model which means certs and MFA regardless of location, behavior, etc.

Obviously a lot we can only speculate about.

I've worked in big companies like Microsoft, so can only comment from that perspective. Due to their size, they often do not have MFA regardless of location. Many didn't even use MFA. Most have been moving there, but it was long, multi-year projects. So I wouldn't be surprised if Microsoft doesn't have MFA for everything.

MSFT employee here: I don't know of an internal service that I use that doesn't have MFA.

I am not going to make a broad statement saying they don't exist, I'm just saying I haven't found one yet. It's really annoying because I rarely have my phone on me when I'm at home so I have to go track it down. I'd be so happy if they let me use a yubikey :(

MFA was standard in industry leaders 10 years ago.

I read it as the possibility that MS source was somewhere it didn’t belong, but who knows?

A company like Microsoft probably gets “hacked” what, a hundred times a day? A thousand?

Can you elaborate on your point?

What I am saying is that these credentials can be stolen from MITM attacks, log files stored on random servers, or even basic mistakes like literally writing the password where other people can see it.

Knowing what kind of operational mistakes Microsoft made that led to account compromises would help others from becoming victim to similar attacks.

If they were the ones responsible for leaking the XP source not long ago, then they deserve much thanks from the underground retrocomputing and software preservation community --- MS would've likely never opened that source themselves. In the same way that those who leak schematics and service information to enable third-party repair are also to be commended. "An enemy of an enemy is a friend."

Completely agree, hopefully we get an updated leak. Windows 7 would be fantastic to have out in the open.

MS source code leaks to the public all the time. I think there was one early last year.

Though this is bad for Microsoft, does it make the situation substantially worse from a security perspective? Assuming they’re following good practices like not storing access keys, passwords, etc, in their source control system(s), this seems like more of an IP protection issue.

I could be wrong about that, though, and I’d be curious to learn and understand more.

If SolarWinds was compromised and the attackers could use that as a backdoor into Microsoft's datacenter, the problem isn't really about protecting source code. The problem is whether attackers were able to leverage that into stealing data from or sabotaging Microsoft customers. After all, that customer list contains many parts of the US government and civilian infrastructure in general, plus major international corporations.

The update literally says that "found no evidence of access to production services or customer data."

There are two aspects to the comment though: 1. Did they access services/data as part of this? 2. Can/did they use what they got to impact customers/gain access to customer data.

The comment in the article speaks to #1. And of course, we have to take that with a grain of salt. I doubt any company impacted by this would be fully honest if there was a customer breach. Regardless, you also can't prove a negative. So all they can really say is what they did. Which doesn't mean services/data weren't compromised. Given the size of Microsoft, I find it hard to believe that every service running there has the logs/audit trail to know whether they were inappropriately accessed.

But I took the OPs comment to be focused on #2 as well. There is a very real possibility that having access to the source code could help the attackers attack customers. Having access to the source code can help in locating vulnerabilities that allow future attacks against customers/services.

Please note: the source code of Windows 10 can be requested if you are a large enterprise or a government already (as long as you agree that you won't release it). The only possible significant difference here is the lag - you can read the source code of the internal builds, whereas you can only access the corresponding source code for stable builds officially. So, if you are a government, you can actually request it for a legitimate purpose and pass it into the other side of that government if you want to.

I think you're misunderstanding my point.

The "risk" mentioned in the quote a few comments up, and in the context of the post by MSRC, isn't about the risk of leaking Microsoft IP. It's about the risk that Microsoft customers might have been affected. Whether or not MSRC found evidence of a breach of customer accounts/data is a related but separate question.

Exploits are much easier to find if you have pure source code and not having to reverse engineer it.

Every state actor already has MS source code, because Microsoft is giving them access (including china).

And this doesn't look like something bored 15 year old would pull, So I doubt it was to access their source.

If I had to guess, they were either trying to find something specific, about one of MS's customers (some gov org) or the target was Azure. Lots of corps keep a lot of data there.

Assuming your source isn't a fucking mess, is commented, APIs documented, etc

Right. One place I worked would probably benefit from attackers getting access to the source code. It would cost them weeks of productivity trying to figure it out.

The core Windows source code is surprisingly readable/well written, I've heard.

No, it’s still much easier.

We are morons!

http://atdt.freeshell.org/k5/story_2004_2_15_71552_7795.html

> Despite the above, the quality of the code is generally excellent. Modules are small, and procedures generally fit on a single screen. The commenting is very detailed about intentions, but doesn't fall into "add one to i" redundancy.

It just lowers the cost of exploit development, that's all.

Umm, that IS a big deal for the most deployed normal-user OS in the world.

...if you're a normal user.

Or in charge of protecting them.

There was at least one SAML bug found in Office 365 federation some years back that would allow anyone to log into anyone else's account.

Funny usage of the MS defender for the link to the "inner source" wikipedia entry:

https://nam06.safelinks.protection.outlook.com/?url=https%3A...

Funny thing is, MS Defender was originally written entirely in VB 6 (the 1998 one, not .Net). MS re-wrote it in C++ out of shame, mostly.

https://web.archive.org/web/20150107212718/http://winsupersi...

Something bizarre in that URL

Safe Links feature:

https://support.microsoft.com/en-us/office/advanced-outlook-...

https://docs.microsoft.com/en-us/microsoft-365/security/offi...

Is the source code buildable, or is it mainly for documentation purposes? I’m guessing the build system and tool chains required for building windows are massively complex. Are these distributed with the windows source code as well?

Also I’m guessing that there are a lot of other proprietary vendor-supplied pieces that get built with Windows. What happens if these are not available?

Internal builds barely work with millions of dollars and man power invested. I can’t imagine anyone else outside of Msft being able to build Windows lol

You're going to love this

https://tech.slashdot.org/story/20/09/30/1843232/windows-xp-...

closed source = only the badguys get to see it. :-(

I don't know if I missed it in the article, but did they say anything explicit about write access? Seeing the source may give access to new zero days, but it would be much worse if the attackers were able to seed a large number of commits into the code that introduce subtle vulnerabilities.

Sounds like the attackers did not have write access. From the original blog post:

> The account did not have permissions to modify any code or engineering systems and our investigation further confirmed no changes were made. These accounts were investigated and remediated.

I would also hope that direct commits don’t go immediately to a production system without some sort of review. At my workplace we have branch protections for all “main” branches that would result in a deployment. At least one other person has to review changes and all of our automated checks have to pass before anything can even get close to running through a deployment pipeline.

Whew, that's good to hear. I assume anyone trying to inject malicious code is going to try to do so in a way that doesn't go through normal code review channels.

True. However, hopefully that’s being mitigated through things like not allowing authors to review their own commits, not using the same accounts to push code changes and do deployments (i.e. having a read-only account for deployments), etc.

However, if it were an admin account that were breached that would definitely make it possible to circumvent any number of protections in place.

At least for the projects I work with at Microsoft, nearly no user accounts have direct write access to source repos. Checkins are done by a service account only after a pull request has successfully been built and run tests, and has been signed off on by appropriate users -- e.g. I can't sign off on my own PR.

EDIT: Sorry, somehow I missed the reply by thatsamonad or I would have replied to it instead of its parent.

I meam it sounds like a good security mesuare but also like a pain to work with? I have recurring nightmare that management realize that submits can be blocked if they generate CI warnings and there will be no warnings anymore.

Tools that generate warnings can be configured to only do so on new or modified code. We do the same for our code. It can be a difficult, but ultimately some codebases require it.

This reminds me of The Linux Backdoor Attempt of 2003[0], when someone (maybe a three-letter agency, maybe not) was able to insert a subtle bug in the Linux kernel.

[0]: https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-...

> was able to insert a subtle bug in the Linux kernel.

... was able to insert a bug into a mirror of the kernel, which was caught in short order.

... which was caught in short order

That means nothing, of course it was caught, otherwise we'd never had heard about it. We can only speculate about the ones that haven't been caught...

We can look at why it was caught (people paying attention to commits, policy of requiring commits to be properly signed off), and conclude that it would be difficult to add anything without being caught. Or, put differently, if you believe that bad actors can get around that level of precautions, you might as well give up because everything else would be equally compromised.

I thought BitKeeper was the main repo and CVS was the mirror?

Yeah, from that link:

> But some people didn’t like BitKeeper, so a second copy of the source code was kept so that developers could get the code via another code system called CVS. The CVS copy of the code was a direct clone of the primary BitKeeper copy.

Reading this, the question that immediately pops in my head is:

Could a hack like this one go undetected for so long in a widely used free/open-source project developed in the open, such as the Linux kernel?

While I have no doubt that something like this could happen to the Linux kernel source code (because security is Capital-H Hard), my perception is that something like this is less likely to happen to the Linux kernel -- and, were it to happen, it would likely be detected sooner, due to the inherent transparency of widely used open-source code.

This hack wasn't really a failure of code construction but a failure of institutional practices. The same thing could have happened if SolarWinds had a garbagy sys admin tool that happened to also be open source but still otherwise followed the procedures of SolarWinds.

Giant bureaucracies have a bunch of tasks they need to accomplish. Giant bureaucracies hire poorly trained people to accomplish those tasks and buy software to aid it's those people in accomplishing those tasks. The software is sold "by the feature" so it is colloquially "garbage" that is itself produced as cheaply as necessary to achieve these features. Naturally, such garbage is constantly updated and all these giant bureaucracies are sieves with these updates running through them. Sure, if these bureaucracies hired competent people, downloaded open source tools, tested the tools themselves and essentially had their own quality control in-house, this might not have happened. But that wouldn't be the out-sourcing-based, cut costs and skills to the bone, neoliberal paradigm that's near and dear to the high level managers' heart, now would it?

Now, you would think that an event like this would create a realization "what we do is too important for outsourcing, for bargain-basement, neoliberal style operations". But the Office of Personnel Management hack [1] was what should have created this realization and didn't.

[1] https://en.wikipedia.org/wiki/Office_of_Personnel_Management...

Code was added once to Debian (IIRC) and it was detected almost immediately due to code signing.

The exploit in this case had access to the build (and presumably signing) system. That wouldn't have helped. The protection against this would have been the comparatively new efforts at reproducible builds. A modified binary, in theory, could be detected by current Fedora and Ubuntu releases (not sure about Debian or other distros). I don't think we've had an attack in practice though.

On the other hand, Debian broke OpenSSL generation and didn't detect it for almost 2 years. That appears to have been a legitimate mistake, but it is quite conceivable that a malicious actor gets a change merged that contains a backdoor that looks like an innocent mistake and goes undetected for a long time.

I suspect adding bugdoors to Linux is far easier than it is than for Windows, but there are already so many bugs it's easier and more viable to just look for them than to try to insert them.

Why would you need to back door Linux when you can find a company like Solarwinds that is already in most networks with greater access to the network as a whole than a Linux server.

Considering how long bugs can go unfixed and undetected even in large open source projects, I think it can totally happen. Just create a backdoor that looks like an honest mistake, submit it in a PR that adds some feature or fix, and exploit it at will as people update. Heartbleed took over 2 years to find and fix.

As others (and Microsoft) mentioned, it was read only access. The only points of concern here would be if that statement somehow was not true and they were able to add undetected changes, or if their security audit process was severely lacking.

But yeah, to your point - being able to read and analyze the Linux kernel source is considered a feature, not a liability :)

I think you're connecting two points he made that weren't connected.

On the one hand, open source projects make for an environment where bad actors could propose changes to the software that include these bug/backdoors. The benefit to the open source arena is that these changes can easily be analyzed and tested.

In Microsoft's case, the source being visible but not editable is still a real risk (assuming the bad actor is able to extract the data they're viewing for further analysis), because they can use the source to determine avenues for attack.

The fact that is was read-only does help ensure that no new attack vectors were created, but it still increases the chance of new attack vectors being found/used in the future.

I do security research and bug bounties on side sometimes and had read/write access to a couple of large open source projects in the past, incl. being able to impersonate employees from well known companies that work on open source stuff.

Most common issue was access tokens found in public places.

Would be interesting to know what happens when code is updated - which I obviously wouldn't do. Wonder how long it would take until caught.

Since open source projects probably dont do "red teaming" (to use a fancy buzz word) I wonder how they could practice this?

A kernel breach happened on iirc an SVN server in 2013 but was detected almost immediately.

If I were a nation state I wouldn’t try to poison mainline kernel - there would be far easier sources along the stack for both local and remote attacks which would more easily go unnoticed. Tools that come to mind are systemd, openssh, http/ftp services, GNU tools and common non-gnu shell utilities. Failing that, distribution level kernels would be my next bet purely because any commits would be less scrutinised.

The attack surface is so large, I'm surprised we're not dealing with backdoors much more often (not just nation states, but also commercial hacker groups).

Yeah, a tweet said this is the beginning of a decade of those sorts of attacks which I agree with. It’ll start with pip, npm, etc, then move to bigger targets.

For that reason I’ve moved away from those managers and stuff like react (I trust facebook but dependency trees are huge) - the worst part is you can’t not patch, but you might be doomed by any upgrade.

I think eventually it’ll snuff out innovation in medium sized businesses and government - large businesses can afford the cost of manual review and startups will ignore the risk, but middle-tier will be screwed.

I’d love to see a crowdsourced review model, but I just don’t think it can be viable without getting abused.

There's a very old homily that applies exactly to this flaming debacle: don't put all your eggs in one basket.

WP says that SolarWinds "had about 300,000 customers as of December 2020, including nearly all Fortune 500 companies and numerous federal agencies."

Everyone who thought that was a good idea, for whatever reasons - given the history of security - obviously screwed up badly. When -so many people- go -so wrong-, the problem is clearly bigger than the loss of 'too many secrets'.

I would love to have access to NT source code, hopefully it leaks. The most recent leaks are way out of date and have basically been exhausted of their usefulness.

What's the logic of using the same remote monitoring software on "computers" used by the intelligence community.

It's simple: open source Microsoft, then this is not an attack vector any more ;)

Of course, it absolutely HAS to be a nation-state. There's just no way anybody not being paid millions of dollars could possibly break their ironclad blah blah whatever you get it

Many comment threads here discussing the (in)ability of an attacker to modify the source-code that Microsoft builds from, or use it to more easily discover vulnerabilities.

What I've not seen anyone discuss is the potential for an attacker to take the source-code of a single Windows core component (a system DLL for example), add in a backdoor, build it and then distribute the binary via a compromise such as the SolarWinds update mechanism.

In other words, insert a modified core Windows DLL into some other popular Windows driver or application package updater published and signed via a 'trusted' channel other than Microsoft itself.

Code signing makes that pretty tricky. System DLLs will have integrity checks against msft certs.

Not all of them. msimg32.dll has no certificate and many system processes attempt to load that. There are more dlls in system32 if you look. Neither does Wldap32.dll, which gets loaded into lsass and is part of the knowndlls...

If they had also inserted themselves into the update chain, things would've been a little worse.

I wonder if incidents like this will push MS towards open sourcing windows.

IDK what their revenue looks like, but I'm guessing that selling the OS isn't as front and center as it used to be (from the way they are changing in terms of supporting things like linux).

Even if they keep a pretty tight license around the source, releasing it to the public would earn a lot of good will while potentially finding and fixing security problems.

(I work for MS but not on Windows.)

I don't think Windows will be open-sourced precisely because it's not as important as it used to be. It'd be a ton of work to root out vendor code incompatible with OSS licensing, remove internal dependencies etc. That's not worth it unless we have big plans for Windows to stay relevant, which I have no knowledge of but suspect that we don't.

Probably we'll see the most relevant pieces be opened up, like the driver model awhile back.

So while not the whole thing, seems like they could open source core pieces like the kernel. That will probably take some code reorg to achieve though so maybe that's why it'll never happen. Last I heard on HN, windows was pretty much just a giant repo with everything in it. That'd have to change for them to release core pieces (If it hasn't already).

FWIW, Microsoft has been slowly shifting some components to OSS (Command Prompt, Windows Terminal, Calculator, WinUI).

Disclaimer: work at Microsoft but in Azure

Calculator

The horrible new version that is ridiculously huge, phones home, and somehow is slow enough to need a loading screen?

I really wish they would've just opened the good one, but you can already find that one in the leaked 2k source...

As far as community trust goes, MS has been killing it for the last several years. They've done a 180 in terms of being good software citizens. I'm really hopeful that core pieces (such as the kernel) end up hitting the public eye.

They can open source it and still keep the copyright. I mean it is not automatically GPL just becouse they put it on a public git server.

Not if Windows includes source code purchased or licensed from third parties who contractually prohibit MS from publishing their source code.

Which it probably does.

I think IE was based on third party stuff. I’m sure there’s bits of that floating around everywhere.

ncsa mosiac

https://en.wikipedia.org/wiki/Mosaic_(web_browser)

Not without refactoring third party code which is used under license.

I've heard that one of the major obstacles to open sourcing Windows is that a lot of code in the Windows codebase may be proprietary and owned by companies other than Microsoft.

Apparently its also an obstacle for many other closed source programs when it comes to considering a transition to open source

I always thought the reason they charged for their OS was due to their anti-trust lawsuit so as to state that they weren't actively trying to dominate the market or something along those lines? Also, OEM operating systems are kind of circumventing that.

The reason I always heard was that there’s tons of binary blobs in Windows they bought from vendors that’d have to be reimplemented (the zip library is the most notable example).

Russinovich said never say never though, so I don’t know. https://www.wired.com/2015/04/microsoft-open-source-windows-...

Being open source is not correlated with charging licensing fees.

It just means you can read the source.

Some licenses very explicitly prohibit source distribution/publication.

>I wonder if incidents like this will push MS towards open sourcing windows.

What I am thinking as well. Unimaginable if it was 10 years ago, but modern Microsoft seems to be taking a different approach. And Apple desperately need some competition to keep Tim Cook honest.

> SolarWinds hackers were able to access Microsoft source code

Are they OK? Ze googles, they do nothing

Nobody has a choice but to trust microsoft. Amazing.

On the whole this does not affect my perception of Microsoft. In fact it probably tilts it in their favor. They were able to conduct a thorough investigation and figure out the attackers had access to the source. The reality is that while it makes future attacks easier it has already been taken into account for a large majority of risk assessments.

People trash Microsoft a lot but some of the people there are the best in their respective fields.

So true. There’s this funny line in one of Paul Graham’s essays where he says something like “making the wrong technology decision can doom your business - like choosing Windows in the 90s” I got such a kick out of that because I worked for CyberTrader in the 90s; we built our whole platform around Windows and wiped the floor with our competitors. We ended up the top day trading company in the US and were acquired by Charles Schwab for just shy of $500m. But at the time, you pit Windows NT with IOCP against anything else and it was game over in the low latency trading space.

Reading the old NT debugging blogs and Raymond Chan’s stuff was very eye-opening. Microsoft has incredibly talented engineers ready to help Solve Problems, not just toss you the source code and wish you luck.

Cool, maybe they'll solve the problem of Teams freezing up constantly someday.

That does not happen, even with the beta grade Linux version on Arch (as I run it)

You may have a rubbish internet connection. If you are using a VPN with a slow internet connection, investigate a split tunnel. Teams traffic involves only three IP ranges so it is easy to split out and route direct to shave a fair bit of latency.

Other issues will require more investigation but they are local to you.

Try disabling gpu rendering.

Agree if your computer resources are being utilized over 70 percent teams becomes a nightmare. They could have written it in c++ in the same amount of time and had that thing running smoothly.

This still holds for C# and the .NET ecosystem today, especially amongst SV startups. If only they knew how much faster and better they could be building instead of avoiding it for ideological reasons.

Except that those ideological reasons are more important than faster and better... even assuming that is true.

Except those same startups are more than happy using FOSS tools paid with Facebook, Amazon and Google money.

The three heroes of ethics, ideal working conditions and examples of behaviour towards the society in general.

What reasons? Do you have an example? Ideological is usually the opposite of rational.

What ideological reasons? Are you claiming SV startups use open source alternatives because of "free software" or what?

The only reason most startups use open source ecosystems is economics.

.Net core is free and open source and compatible with linux

Funny enough in 'founders at work' it sheds light on the early days of paypal. It seems to point towards one of the reasons Elon got fired as CEO of Paypal is because the broader team disagreed with Elon about whether to build around windows or linux and Elon argued that there was more tooling in windows at the time.

That’s consistent with the biography by Ashlee Vance: Elon pushed for Windows and C++ because he believed it was a more mature ecosystem.

I worked on a big distributed system with C# and windows servers. Was rock solid I miss it so much. I'm not drowning in Java/Spring/Linux app its such a horrible mess, security is the worst nightmare but even stuff like NFS is regularly breaks. Windows was great.

Well, things have a tendency to come full-circle again. Maybe with the cloud offerings, we'll realize that open-source isn't so great and go back to more proprietary offerings.

C# is basically the same thing from a VM perspective, an interpreted bytecoded high-level language, but tied to windows. You can write architecture astronaut shit in C# just as much as Java.

The nice thing about Java is the deployment and management tooling. It's cross-platform and mature. C# is not nearly as good in this respect, although with the open-source it is finally free to move with that.

> C# is basically the same thing from a VM perspective, an interpreted bytecoded high-level language, but tied to windows.

C#/.NET hasn't been tied to windows for a number of years now. .NET Core/.NET 5 is cross-platform and great to work with. All of our CI/CD runs on Linux agents too.

> C# is basically the same thing from a VM perspective, an interpreted bytecoded high-level language, but tied to windows

C# is not tied to Windows, some new features in the latest C# 9.0 doesn't even support running on the Windows-only classic .NET Framework.

All new .NET development + C# features is being invested into .NET 5+ (FKA .NET Core), i.e. the high-performance cross-platform runtime.

> The nice thing about Java is the deployment and management tooling. It's cross-platform and mature. C# is not nearly as good in this respect, although with the open-source it is finally free to move with that.

Citation needed, I deploy my .NET 5 Apps with Linux tools, either rsync, Docker as well as AWS ECS. All clean + simple, only requires a single command to publish your App ready for distribution, that you can either rsync across or include it in the runtime image of your Docker build.

Tried to publish a Java package last week and the whole experience was a shit show, by far the worst experience of all languages where the recommendation to publish a package is to push it to bintray first, make it available to jCenter than sync it to Maven, where you need to get manual approval to include it in jCenter then you need to create yet another account/credentials with a 3rd Party which requires a manual request via a damn Jira ticket. Then each package manager has different requirements as to what a package needs, I could publish it to bintray but couldn't get it to jCenter without uploading a POM which new Kotlin projects aren't created with, then MavenCentral requires a stricter POM and Java Docs but there's no standard way to publish to a repository as bintray needs their own non-compatible task, so now I have duplicated generated POM's in my gradle build to satisfy different repositories, for bintray I needed to hook into their bintrayUpload task and generate the POM just just before it uploaded the package which I needed to decompile its sources to find out where exactly the POM file needs to be written to, no examples of which existed for Kotlin build.gradle.kts scripts that new Kotlin projects are created with. Then there's the case that every build.gradle example uses configuration that is already deprecated and Java/gradle seems to be the only one requiring uploading binary .jar's with your source projects.

Every other language has a single repository you can publish to that you don't need to jump hoops to get, published using standard tools, simple, clean, straight-forward & well documented.

> an interpreted bytecoded high-level language

Something C# never was, given that it always JITs before execution and AOT compilation to dynamic libraries has been available since version 1.0 via NGEN.

Plus lots of additional AOT alternatives like Windows 8.x Bartok compiler, .NET Native and CoreRT.

This on top of third party offerings like Mono AOT or IL2CPP, and the research compilers from Singularity and Midori projects.

Whereas for Java, while AOT has been available since around 2000, it has been for the most part only available on commercial JDKs, and free beer AOT only came with the release of GraalVM community, the addition of J/Rockit JIT caches into OpenJDK, and IBM releasing OpenJ9 as FOSS as well.

Agreed C# and Java are virtually identical. However the cultuer is completely different. The plethora of libraries to me ends up being a handicap. We have had a bunch of different Java developers on our project and each one does things differently so we end up with a huge mess. I didn't see such problems in C# world where maybe we just had better devs that concentrated on clean models instead of incorporating fashionable libraries and other moving parts.

Your opinion on C# is outdated by at least 5 years of massive changes in the entire .NET ecosystem.

> C# is basically the same thing

Abstracted far enough, everything is basically the same thing.

> C# is not nearly as good in this respect.

How so, I had nothing but issues when trying to deploy cross-platform Java because of the Java ecosystem itself being bad compared to C# or Golang where you just compile stuff and run it.

Do people still trash Microsoft? Maybe it's just because I'm in Seattle, but I feel like their reputation has really turned a corner in the past year or two.

There's still a lot of cruft from who they used to be, but I feel like most people I know echo the sentiment that Satya has been a revolution. Things like them embracing Linux, acquiring and not ruining NPM and Github, contributing to open source projects, and all the work they've done with Dotnet Core seem to really have bought them a lot of goodwill, at least with the people I know.

Yes, people still thrash Microsoft because many of their business practises and products are thrashy, even if it needn't be.

Windows is a great example - forced updates, forced ads, forced data-ming and spying, stupid UI changes etc. all make an otherwise decent OS a real pain to use and a must-avoid for the privacy conscious. These are easy to fix for a company like MS, but they do not.

> forced updates

I don't understand whinning about that when you have bilions of people using your OS, so shitton of people who are newbies at computers then you want to help them to stay as secure as possible.

"at best(worst?)" this thing is "not nicest", but it's totally reasonable.

you have reasonable control over updates on non-home versions, imo.

It's very jarring for an inanimate object that you are trying to wield as a tool, to suddenly have its own agency and its own priorities that it treats as more important than yours. "No, I'm busy for the next 40 minutes" and "Sorry, I have to go now" are things you hear from your friend, not from your hammer or or your toaster.

I don't mind Chrome's forced auto-updates, because they've never gotten in my way.

People complain about forced updates because updates have come down that inexplicably break things. For example there was one update in 2020 that caused appeared to delete any files placed in the users Desktop folder (although the files weren't really deleted) and another which caused running chkdsk to corrupt users filesystem in a fashion that typically required fixing the filesystem offline.

Furthermore such updates which usually require a reboot can easily interrupt important work or a long running task.

Just yesterday my Windows install which exists solely to run steam and steam games updated and then committed suicide in a fashion that can't be automatically repaired and requires a reinstall with zero explanation. For reference the hardware is fine as is the Linux install on another drive. The windows drive is a ssd less than 6 months old. I can even mount the ntfs filesystem which appears to be just fine.

There is absolutely no excuse for not letting users pick when or if they would like to update their OS especially when their QA has completely gone to shit and they cannot realistically promise that their update wont break your install.

Especially, as Windows updates, given basically infinite combination of hardware (often broken) and software (broken even more often) are super rock solid.

People who are newbies at computers wouldn't be able to find the switch to turn off updates anyway, so why not include the opt-out setting for users who care?

Forced updates are unnecessary and a bad idea, even more so in rolling-release models.

I dislike the forced windows update because they shove crap down your throat with the updates, try to force edge on you, and repeatedly try to get you to accept their privacy stuff.

>I don't understand whinning about that when you have bilions of people using your OS, so shitton of people who are newbies at computers then you want to help them to stay as secure as possible.

That doesn't explain forced feature updates.

Yet chrome forced updates are the greatest revolution it's modern software solutions.

I think he meant frequent and unpredictable forced reboots. But the updates are also a disaster. Microsoft trying to shoves their shitty apps down our throat every time, resetting the default applications regularly.

The thing that finally got me to abandon Windows was when a forced update wiped away the system settings that I had spent days figuring out to get a trackpad to work the way I wanted to.

I wonder how many people who complain about forced updates also complain(ed) about having to support users running decade-old versions of the OS/browsers?

It really wasn't that long ago that most commercial software still had to support IE8 (released 2009), for example, because that's where the user base was and they didn't upgrade.

what forced ads? I only know the start menu candy crush stuff, but I remove those first thing after installation.

Comes back with every update.

They are doing this to survive, not because they love open source and Linux. MS is still every ounce of the company they were in the 90s, they just saw the writing on the wall and decided to play for the new generation of developers. I don't trust them any better.

We're fortunate that Microsoft shareholders think catering to developers is good for business. Not every megacorp thinks so. I mean, take a look at Swift's documentation and tell me with a straight face that Apple cares about developers.

While Windows 10 i pretty good and stable system, the bundled programs that are default for photos etc are truly awful. In corporate environments it's often hard or impossible to install 3rd party programs, so when the default bundled software suck, it is frustrating to deal with...

whats so aweful about the default photos app? how can it be better?

Install irfanview and compare.

> Things like them embracing Linux

Have you seen the WSL2 DirectX support?[0] They're extending it, too!

[0]: https://news.ycombinator.com/item?id=23241040

They'll extinguish desktop Linux any day now!

It's funny because Linux did just that to Unix. Embrace (new OS that does everything Unix does, and free!), extend (Linux has features not found in classic Unixes), extinguish (Linux is now the de facto standard, so anyone who wants to use Unix is laughed at).

Microsoft gets mocked for embrace/extend/extinguish, but really, it means just do a better job than the competition. Embrace: "do what others are doing", extend: "do a better job at it, have more features than the competition", extinguish: "sell customers on those features and improvements". How anyone could be against competition, simply because it's framed in a cheesy phrase, is beyond me.

> Do people still trash Microsoft?

Microsoft is a big company. Some things it does will always be trashy - like fighting tooth and nails to keep Linux desktops and truly-open formats out of European public-service procurement. That's still going on, 20 years and 2 CEOs later, and will probably never stop, because screw public interest when there is so much money on the line!

But sure, in some areas they behave better now. They had no choice, after losing a whole generation of developers and seeing their cash-cows (Windows, Office, and AD/Exchange) under siege from SaaS insurgents. I've still to see something where their efforts are not fundamentally tied to their immediate self-interest, though.

Microsoft is a very large company with many different internal orgs, your experience will vary greatly from one to the other (or product to product)

Could be my neck of the woods too but where I am Microsoft has the best reputation among the Major tech companies (not a privacy nightmare, great research division, has started supporting open source, remains fairly apolitical)

> and all the work they've done with Dotnet Core seem to really have bought them a lot of goodwill, at least with the people I know.

Microsoft has done some good things with .NET Core, but they still don't have a very friendly OSS or partner strategy.

AppGet is a pretty good example; there was an existing Open source solution that filled a need, and Microsoft decided to create their own replacement, not bothering to give any credit (until there was an internet ruckus) to the original despite the very striking similarities and relative level of obviousness that they were at bare minimum 'inspired' by the tool; after all, they interviewed him for a role and even warned him the day before it came out... [0]

Octopus is another example. I -hate- TFS Release pipelines. Octopus Deploy was (until they ruined their pricing model) a far superior product overall. You can really tell the way TFS Release pipelines were done, they tried to 'checkbox-copy' Octopus Deploy's features without making it too much like Octopus to be obvious.

But the checkbox-copy strategy is inferior in many ways. In Octo you can have a stage that runs in all environments (but certain steps on/off per env) and configure server groups that way. In TFS Release, You have to have to 'copy' the steps for every stage. It's like their data model is missing a 1-many relationship or two somewhere.

And the impacts in the case of their behavior has a second-order effect; I am curious whether TFS Release eating into Octopus's market share was a factor in their price hikes a couple years ago; in that regard, I can't blame them if that's the case.

[0] - https://medium.com/@keivan/the-day-appget-died-e9a5c96c8b22

Microsoft is like the government... everyone has a relationship with them, and those experiences vary from high trust / strategic down to a sort of taxman.

If your work is such that scaling to bazillions of servers or other artifacts isn’t an issue, Microsoft is a smart choice. If you are building Facebook, it is a dumb choice.

I think using their dev tools is a solid choice. Using their OS or their DB... not so much, primarily due to licensing.

> Using their OS or their DB... not so much, primarily due to licensing.

The state of SQL Server's MVCC suppot is arguably enough to preclude use even before we talk about licensing.

I never thought I would miss Oracle until I learned about NOLOCK and the cost of enabling MVCC in SQL Server.

I only wish more of those tools would be cross platform. I know it's not happening, but it'd be nice if I could develop WPF stuff right on my macbook without a VM.

> acquiring and not ruining NPM and Github

a little early to come to this conclusion, one way or another, I think

Brands can turn money into goodwill, given enough money, time, and skill.

I don't think this is some fundamental shift in Microsoft or its values: simply a shift in their market positioning and brand value/identity.

Their products are still proprietary spyware, designed to get as many people locked into the Windows (or now Azure) licensing ecosystem as possible. Even the best parts of VS Code, often cited as one of their best new releases, are either spyware or proprietary. Windows remains a tire fire.

GitHub and NPM are prime examples of this concept that one can turn money into goodwill. I assume money also changed hands for the first-class support that Docker has for windows.

A lot of people don't update their opinions because it takes work. I know because I've made it habit of checking my assumptions and I still forget. For example, people still trash PHP and post a "A Fractal of Bad Design" when PHP 8 is now on par with any other language and not an amateur minefield. Some things get better, some things get worse. It's best to check in once in awhile. Microsoft is much better than it was 20 years ago.

Good point and maybe true for PHP, but not for Microsoft or its products. They've continued to "update" their bad practices too, and it's not just old criticisms that are rehashed again against them.

And no, to me Microsoft is actually worse than before as they have turned Windows into a spyware. The forced updates (not just security updates) make it even worse.

Developers opinions don't seem to have changed that much

https://insights.stackoverflow.com/survey/2020#technology-mo...

Maybe they are all wrong. Maybe PHP still sucks just less.

That's because there's a ton of legacy PHP code to deal with. I shudder to think about it.

They do on Hacker News! People here seem oblivious to the fact that Microsoft is right behind Apple in valuation.

What does this valuation matter?

There is some correlation between selling good products and valuation. Intel's valuation for example went down 25% in 2020 in contrast to the NASDAQ US Composite index (of which Intel is a part) which went up over 40%.

My problems with microsoft really aren't around their security practices (these days).

It's more around the ads in the start menu, the telemetry they send, and their tendency to reset my telemetry settings around updates.

I don't feel like I'm in full control when I'm using a computer running windows. Which, y'know, is probably fine for 95% of computer users, they want more of an appliance than a general computing experience.

> I don't feel like I'm in full control when I'm using a computer running windows.

Yes, they've started imitating macOs / ios and have even gone beyond what Apple does in blatantly turning Windows OS into a spyware.

Running an .exe in Windows on a slow internet connection doesn't slow down Windows,so they are not there yet.

It does if it has to go through the Windows Defender check. Enough that sometimes I end up launching the same thing multiple times because I get gaslit into assuming I haven't launched it.

I mean, true they detected this but you don't know what you don't know...

This does not change my perception of Microsoft either.

Doesn't mean they don't deserve the criticism or thrash directed at them for their products or business practices.

>>> They were able to conduct a thorough investigation

Prove that.

Here's the updated Microsoft post that contains the admission that the hackers viewed source code:

https://msrc-blog.microsoft.com/2020/12/31/microsoft-interna...

Drives me crazy that Reuters could write an entire post about a Microsoft blog post, yet not link to the post itself.

If you've been following this story you'll realize that someone at Reuters really has it in for Microsoft. This despite the backlash they've seen in the community for their rather tenuous leaps of logic (see for instance this gem: https://in.reuters.com/article/global-cyber-usa/suspected-ru...).

You'll note that they buried the byline in this piece at the bottom, crediting "Reuters staff" at the top.

Trying to understand:

You're saying Reuters shouldn't report severe security breaches at Microsoft? Or that they are doing it because someone there dislikes Microsoft? For the latter - does the motivation really matter?

I was responding to a comment about why Reuters didn't link their source for the article by pointing out that it's consistent with their coverage of trying to sensationalize a pretty boring story. If they linked the Microsoft blog post, people might realize that the story isn't what Reuters is trying to spin it as.

Their motivation of generating click-bait at Microsoft's expense matters as it means you should seek clarifying information from other sources. Or just ignore Reuters and hope the drop in traffic drives them to more closely tell the whole story.

But the Reuters piece (https://www.reuters.com/article/us-global-cyber-microsoft/so...) is on point. Microsoft was in fact breached and attacker(s) accessed source code.

Simplified, sure, but not overly so.

(Linking or not linking to corporate blog posts - I agree they should do that, but I suspect it's a general article style guide thing.)

Ok, we've changed to that from https://www.reuters.com/article/us-global-cyber-microsoft/so.... Thanks!

It drives me crazy when in 2020 news articles do not link to sources.

Why would they? Will it increase revenue if they do?

Because the goal of news should be to inform, especially when talking about court filings, and we as viewers should not give traffic to sites that don't do basic linking work.

I believe parent was being rhetorical and or facetious.

What we believe organizations should do and what they actually do in is often misaligned based on problematic underlying driving forces/goals.

Profit motives have tended to overcome all other incentives in our (the US) economic structure. It may be a broader problem globally due to power and influence of the US.

The same can be said about consumer motives. I probably should shop locally more often, but I may not be able to afford local rates and have to pass the costs down the line if I want to continue supply more basic underlying goals (eating, staying sheltered, etc).

At some point we have to have the difficult conversations of choosing the tradeoffs we do and don't want to support, otherwise we may let flawed underlying goal structures guide us to the paths of least resistance, which may ultimately not be good for humanity (or it may be, who knows).

Given a lot of current directions, I find it hard to believe our underlying system structures are great for human well being. It may have been a good run for awhile but that may be a short temporal anomaly. We may have to more throughly consider long term consequences of goals we set that may run counter to their actual intent.

It's easy for some to simply ignore the underlying problems and play the game optimally for oneself. Personally, I've never been happy with that option (the option which OP sort of alludes to).

Because it's what their customers want? Higher quality news sources have begun to get it (even if 10 years late).

If 2020 has taught us anything, it’s that including sources will only lead to them being questioned to refute the article’s premise.

Them Covington High Schoolers would like to have a word. It took me under 10 minutes to do what CNN didn't bother to do: confirm the claims of one man. It cost them dearly, and rightfully so.

Many security companies' stock went up upon release of this news, as they have done in the last 2 weeks.

I'd not be surprise if someone in Reuters is profitting from hyping the breach.

IIRC Bloomberg news rewards stock price changes directly.

Original blog post by Microsoft - https://msrc-blog.microsoft.com/2020/12/31/microsoft-interna...

I'm sure they got linux's too.

Poor hackers. I hear Visene soothes bleeding eyes.

Your comment breaks several guidelines here.

https://news.ycombinator.com/newsguidelines.html

> Microsoft said the account did not have the ability to monitor any Microsoft code. The blog post further added it has found no evidence of access “to production services or customer data.”

The article is in contradiction with the headline, isn't it?

The reuters link posted here is click-bait junk. This section from the Microsoft blog provides better context.

>We detected unusual activity with a small number of internal accounts and upon review, we discovered one account had been used to view source code in a number of source code repositories. The account did not have permissions to modify any code or engineering systems and our investigation further confirmed no changes were made. These accounts were investigated and remediated.

>At Microsoft, we have an inner source approach – the use of open source software development best practices and an open source-like culture – to making source code viewable within Microsoft. This means we do not rely on the secrecy of source code for the security of products, and our threat models assume that attackers have knowledge of source code. So viewing source code isn’t tied to elevation of risk.

https://msrc-blog.microsoft.com/2020/12/31/microsoft-interna...

Sure they don’t do security through obscurity but any pen-tester will tell you that whitebox knowledge is certainly a huge help.

> At Microsoft, we have an inner source approach – the use of open source software development best practices and an open source-like culture

MS has an "open source" culture? I laughed and remain skeptical ...

Not untrue. Internal orgs adopt a monorepo structure - the source for the majority of the infra is readable from almost any developer within the company.

I figured that’s where Raymond Chen gets the bulk of his material from: looking at the perforce/sd diffs from 1997.

They specifically said it's _not_ open source. Hence the open source-like. To distinguish, they even have a different name for it - inner source.

> To distinguish, they even have a different name for it - inner source.

Yeah, I recognize MBA speak when I see it. That's why I chuckled. They were hacked and somebody saw their code. Now some guy in upper management has to spew some bullshit to protect the company's "image".

The term "inner source" was not coined by Microsoft. The wikipedia page [1] shows the history of the term.

1: https://en.wikipedia.org/wiki/Inner_source

If somebody needed an example of open source washing...

If you go back to the original CISA post December 17, 2020 they noted a different attack vector other than SolarWinds had compromised some systems.

This seems like a very serious breach. Expect zero-days to run rampant the next 10 years.

I don't know if to pat Microsoft on the back or give the ma scolding.

If you are up against a military intelligence hell bent on discovering attack vectors produced by the private commercial industry then this is a losing battle-whoever has infinite resources win.

In this case the governments of the world can print unlimited money and has to access to the top of the creme, we are talking 0.0001% of the population working on discovering the next zero day vulnerability.

How does a for profit corporation go up against an adversary with infinite resources?

> How does a for profit corporation go up against an adversary with infinite resources?

The largest corporations are wealthier than some nations. Governments do not have unlimited resources. When national security depends on corporate security, governments can subsidize it with some other parts of their own "infinite resources".

Not saying I disagree with your point overall, but this rhetoric rubs me the wrong way.

> Governments do not have unlimited resources.

Who owns the money printers? Is it microsoft or is it the governments recognized by the USGOV?

Who has control over the monetary supply? Is it microsoft or is it the governments who control respective central bank?

Who has control over deciding whether microsoft is a monopoly or not? Again, its not the corporation.

Sure you can have corporations richer than most developing nations but that has no relevance on the policy/power balance between government and a corporation.

Even if all of the corporations in America formed a coalition, it is the government which has monpoly over violence that can decide out of whim if you are suddenly against them or with them.

Why would basic facts rub you the wrong way? Do you believe that corporations can control the military, police and paramilitary forces in the Western world?

Reply on news.ycombinator.com