Hacker News Reader

Comment by semi-extrinsic | Hacker News Reader

I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws.

Enterprise data security on the "MS Office level" at this point is like driving 60 mph on a road with no lane dividers. You just pray that you never meet a drunk driver or someone texting in oncoming traffic who suddenly swerves into your lane. You pray that none of your employees click the wrong button and bankrupt the company.

View on HN

> worse things like breach of export control laws

The entire Department of Defense runs on PowerPoint, along with all of their contractors. It is not at all uncommon to produce slide decks that are either classified or covered by ITAR; this is a disaster waiting to happen.

Do they run on the same infrastructure as the rest of us?

No. DOD/Gov projects can be hosted in completely secure locations, and Azure for Government follows all the required standards. Office365/Sharepoint supports FedRAMP High. Most agencies are in the process of finishing migrations so that both their desktop and online apps use the same data in secure cloud installations.

Sometimes classified leaks onto unclassified networks via human mistake, coincidence, or ignorance. I've literally seen classified PowerPoint slides marked unclassified due to ignorance. This situation requires security to confiscate all machines the data may have leaked to.

Oh, I've absolutely seen similar, and I don't doubt it's extremely commonplace.

But Microsoft generally supports policies for enforced disabling features like the one referenced in the post. Similarly, data exfiltration from managed to non-managed devices is an entire cottage industry. And generally that's why govt employees are expected to use separate, locked down devices where their compliance-obsessed (hopefully, but not always in practice) admin has total root.

And I don't believe you're implying this, but certainly I don't think it makes sense for companies to _not_ build internet/cloud-connected experiences and features just because there's a possibility that govt officials won't follow their own security policies and best practices.

No they run in isolated networks. No classified DoD networks have any access to the internet.

ITAR regulated information isn't only on the SIPR/High side.

From the perspective of Classified Data this SHOULD not be a problem, but I highlight the "SHOULD" because sometimes these barriers get crossed unintentionally. Mission briefings, etc. may accidentally leak info, and those are almost all PowerPoint.

For the ITAR data though, that's absolutely not only on isolated networks.

I think the user met the same networks on Microsoft's end.

Yeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.

HIPAA is tame compared to export control and classified information handling. Single occurrences can get you 7 or 8 digit fines and prison sentences.

I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow.

I work in healthcare, and the legal department bars me from using Google Analytics for HIPAA reasons.

Meanwhile, IT made Chrome the only browser the employees are allowed to use on every Windows machine in the org.

Did you read the article? I find your jaded sense of cynicism to be different than critical thought. I don't see any proof in the article posted about its claims. It's just very easy to get jaded, cynical people to support the right headlines on social media. Hacker News, be better.

I don't find reaperducer's comment to be jaded or cynical. It sounds perfectly reasonable to me.

Powerpoint is the raison d'etre of an entire class of middling bureaucrats. They'll fight tooth and nail to protect their turf and preserve their role in society.

Can you point to the provision of HIPAA that this is violating?

Yeah. The HIPAA data needs to be encrypted and you have to report everyone who has access and you need patient permission to share. HIPAA is bad, but ITAR violations put you in jail!

If you work in healthcare you know not to put HIPPA data in PowerPoint slides to begin with.

Wouldn't it be easier to ban putting HIPAA protected information into a PowerPoint? We don't ban telephones just because an employee can read patient records over the phone.

PowerPoint should be banned for other reasons, we're just looking for an excuse. :)

Of course putting ePHI in PowerPoint presentations should be against policy. The thing is, when it does happen, it's almost always inadvertent. Unfortunately, the "oops, my bad" defense isn't valid against violations of the HIPAA privacy rule.

If you're putting PHI in a presentation, you probably already have HIPAA problems.

Doctors routinely need to present cases to each other. It often involves pictures of the patient and other identifying information that is essential to describe the case in detail. They need some way to do this.

Any healthcare institution is going to have a Business Associate Agreement[1] with Microsoft. OneDrive is one of the allowed/suggested ways to transmit PHI where I work.

[1] https://www.hhs.gov/hipaa/for-professionals/covered-entities...

exactly .... people here suggesting that putting any PHI into an office document is intrinsically a HIPAA violation are bonkers.

Isn't the "Design Ideas" request going to the same Sharepoint server that is storing your doctor's OneDrive?

I didn't capture and inspect the traffic myself, but https://support.office.com/client/53c77d7b-dc40-45c2-b684-81... makes the feature sound like it's built into M365 and not sending data to some centralized web service.

Sure, but a Word document seems much more likely

HIPAA is prescriptive, not descriptive. It does not lay out specific standards to reach. Only overly vague and broad guidelines. Because of this the industry has more or less developed its own best practices that should be good enough.

What this means is that healthcare providers have annual audits performed by third parties who check compliance with these "best practices" which may or may not have any relation to what the lawmakers intended. Its ultimately about checking boxes. yada yada security is hard. You can't write a law that describes a security posture and expect to be relevant for more than a year at most.

I can't believe how many companies in general are leaking massive amounts of sensitive data to Microsoft. With Outlook alone MS much have an incredible amount of data on nearly every business and an unprecedented amount of insight into what they are doing.

Windows 10 has only made the problem worse. The last desktop PC I got from my company's IT department had windows 10 on it and it was configured to send every last keypress to MS. Why they had the Windows 10 keylogger enabled I'll never understand, but at least it was easy enough to disable.

> is like driving 60 mph on a road with no lane dividers

That’s somewhat funny, because a Landesstraße in Germany has no lane dividers and the speed limit is 100 km/h (about 60 mp/h).

Unless I’m misunderstanding and lane dividers mean the printed lines.

the bar to drive in Germany is significantly higher than in the united states. Requirements for getting a drivers license in America is ridiculously lenient because the American lifestyle is completely car centric. taking someone's license away is tantamount to sentencing someone to poverty.

I think the other possible effect is the maintenance construction work in the Autobahn, which can create an upper speed limit anyway.

Also, only about 70% have no speed limit. https://en.wikipedia.org/wiki/Autobahn (ctrl+f "No speed limit" for a nice table)

The Autobahn has a recommended speed of 130 km/h. OP was talking about Landstraßen having a speed limit of 100 km/h. The two are very different kinds of roads. The Autobahn does have concrete dividers and hard shoulders for example. It also has a much more predictable design compared to a Landstraße.

Germany makes you get a license to play golf. It sounds extreme at first blush but when you start to think about it...

Same speed limit in the UK, and there are roads without painted lines.

The speed limit and the speed you should be driving are different though

In most of the western US, the speed limit is about 10 mph lower than the actual speed of traffic.

Depends. In Germany we try to set the speed limit at the speed you should be driving in clear and dry (or slightly wet) conditions. In Sweden in the other hand I've seen roads where no sane person should be going the posted speed limit

In UK there's basically single track roads that have a speed limit of 60mph, and you'd be crazy to use them at more than 30mph most of the time.

If only a route planner would understand this fact too!

I assume Google Maps has data on average speed its users travel along all the roads.

"Unless I’m misunderstanding and lane dividers mean the printed lines."

Well, we also have plenty of really narrow roads on the countryside, with no lane divider, no printed lines and - no speed limit, where you could do 100 km/h, as well.

(And well, some people do, but if you crash, it would be also legally your fault, for not having the adequate speed, even if there is no formal speed limit. Which is a nice counterexample to the usual, everything is forbidden unless it is explicitely allowed mentality)

There are a lot of roads in the US with a 55MPH speed limit and no lane dividers. In many states, all rural roads with no posted speed-limit have an assumed speed limit of 55MPH. People drive 60 on such roads all the time.

Where I used to live in Texas, there were two-lane rural roads with 75MPH speed limits

Largely true, but worth noting that each state has its own speed limit. Vermont, for instance, sets the state non-highway speed limit at 50MPH, so you'll almost never find 55MPH undivided roads in that state. Colorado, on the other hand, has undivided roads with 65MPH speed limits. Much of the Midwest and the East Coast tend to set their limits at 55MPH, though.

Yeah, my point is not that such roads don't exist, they are relatively common, as you say.

My point is that your only "defense" against oncoming drivers on such roads is to pray that they stay in their own lane. This mostly works because people are mostly sober and undistracted and not malicious. It is kind of terrifying when you start to think about it.

Not so funny considering that more than half of fatal car accidents in Germany happen on exactly those streets (744 in 2021). Followed by Bundesstraßen (606 in 2021), which only sometimes have dividers and are usually limited to 100 km/h as well.

In compare, on the Autobahn, which always has dividers but often has no speed limit at all and is not below 100 km/h under normal circumstances there were "only" 318 deaths.

Source (German language, Federal Statistical Office): https://www-genesis.destatis.de/genesis/online?operation=abr...

Interesting, thanks. Note that your URL does not work, searching for "46241-0003" gets the right category, though.

I do wonder how many of those accidents are related to cars overtaking others.

It's worth pointing out that Landstraßen often have trees next to them for cosmetic and "noise reduction" purposes (the latter has no significant effect, although many people believe in it). They are also not necessarily illuminated and can have crossings or sharp turns in addition to nearby wildlife and houses.

In many cases the roads are also used by cyclists or agricultural vehicles which many drivers feel compelled to overtake, which can be dangerous because of limited vision and the need to switch onto a lane that may contain oncoming traffic.

Compared to the Autobahn, Landstraßen are chaotic and often dangerous, not just for the people driving on it.

Does comparing raw number of deaths here make sense without taking into account the total distance travelled / time spent per person on these different kinds of roads? Not to mention other factors like e.g. how tired/inebriated/distracted the average person using these roads is, which is unlikely to be the same for short distance and long distance travel.

Also 744 < 606 + 318 so it doesn't even seem to be "more than half" even with some road types missing.

+1 for the export control stuff, even if I think it might be worse for MS than for the actual customer. At least I hope...

Edit: As was pointed out elsewhere, the phoning home stuff can be turned off at org level. So MS will not be affected by any fallout of potential export control violations.

This kind of thing in particular should make banks' compliance departments more nervous than usual - Powerpoint is a really key tool for deal teams, and the behaviour is here might just be obscure enough to be missed by people tasked with stopping price-sensitive information slipping out the door.

I am surprised you believe the vast majority of power point users would be handling information that could even breach export laws, or that even the majority of users are making power points to present to people of other nations...

I bet that is less than .01% of all power points created in the world

After the issues with Github Copilot and copyrighted code, my mind is drawn towards similar inadvertent leaking of proprietary information via a model trained on that information.

Reply on news.ycombinator.com