Hacker News Reader

Comment by HenryKissinger | Hacker News Reader

> Microsoft said the account did not have the ability to monitor any Microsoft code. The blog post further added it has found no evidence of access “to production services or customer data.”

The article is in contradiction with the headline, isn't it?

View on HN

The reuters link posted here is click-bait junk. This section from the Microsoft blog provides better context.

>We detected unusual activity with a small number of internal accounts and upon review, we discovered one account had been used to view source code in a number of source code repositories. The account did not have permissions to modify any code or engineering systems and our investigation further confirmed no changes were made. These accounts were investigated and remediated.

>At Microsoft, we have an inner source approach – the use of open source software development best practices and an open source-like culture – to making source code viewable within Microsoft. This means we do not rely on the secrecy of source code for the security of products, and our threat models assume that attackers have knowledge of source code. So viewing source code isn’t tied to elevation of risk.

https://msrc-blog.microsoft.com/2020/12/31/microsoft-interna...

> At Microsoft, we have an inner source approach – the use of open source software development best practices and an open source-like culture

MS has an "open source" culture? I laughed and remain skeptical ...

Not untrue. Internal orgs adopt a monorepo structure - the source for the majority of the infra is readable from almost any developer within the company.

I figured that’s where Raymond Chen gets the bulk of his material from: looking at the perforce/sd diffs from 1997.

They specifically said it's _not_ open source. Hence the open source-like. To distinguish, they even have a different name for it - inner source.

> To distinguish, they even have a different name for it - inner source.

Yeah, I recognize MBA speak when I see it. That's why I chuckled. They were hacked and somebody saw their code. Now some guy in upper management has to spew some bullshit to protect the company's "image".

The term "inner source" was not coined by Microsoft. The wikipedia page [1] shows the history of the term.

1: https://en.wikipedia.org/wiki/Inner_source

Work at MS, that term has been used for a long time internally, certainly longer than I have worked here. It really is very useful to be able to go find the code for a product when you want to understand how something works.

If somebody needed an example of open source washing...

Sure they don’t do security through obscurity but any pen-tester will tell you that whitebox knowledge is certainly a huge help.

If you go back to the original CISA post December 17, 2020 they noted a different attack vector other than SolarWinds had compromised some systems.

Reply on news.ycombinator.com