Hacker News Reader

Comment by bastard_op | Hacker News Reader

He's absolutely right, you really can't trust anything they sign anymore. This is why Microsoft has been so defensive about their stance since it occurred. I've said the same since the news got out, but all my Microsoft-y friends I told didn't care. In fact, they all shrugged it off like "what are ya gonna do?"

That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To Linux?

Certainly not, Microsoft-y admin only know Microsoft, they usually can't do much else, it's all they know. They certainly won't bite the hand the feeds them. That means the organizations are stuck, which is exactly what Microsoft wanted all those years ago with a monopoly, and got it.

Customers too stuck in their own ways to do anything but be a slave to Microsoft and their constant insecurity deserve what they get sadly.

View on HN

> be a slave to Microsoft

Ok. So are you suggesting that the most practicable alternative is to be a slave to [list of 100+ other vendors]? Going out of your way to defenestrate a trillion dollar technology vendor is a bit bananas to me. If you are trying to run a business, I think you are completely fucking yourself over with this sort of attitude.

How much business convenience are you willing to squander over these principles? And, are you truly upholding your principles on a consistent basis or is this a reductive "at least it's not Microsoft" line of thinking? Microsoft is a big place. Some parts good some parts bad. You may be leaving a lot of upside on the table by never considering them as an option.

We are a "Microsoft shop", but we still use other vendors when it makes sense. I don't trip over myself trying to get 100% off AWS over some ridiculous tribalism. Their domain registration and S3 object stores work really well for us so we continue to use them, even when it creates a bit of integration overhead (SCIM identity sync w/ AAD, etc).

From a security angle, every vendor you use will have a security incident at some point in time given enough time. The real question is how the incident is handled. My issue with the “Microsoft had a security incident obviously you should Migrate away” mentality is that this could be any one of your vendors and if your philosophy/strategy is to ditch your vendors whenever a security incident happens you’re not going to get very far. Anything else like ditching Microsoft but not vendor X or using this to justify no more MS is inconsistent logic.

Edit:

Adding a quote from the OP’s linked blog on the subject:

> There is this well cited argument that cloud companies like Google, Apple, Amazon, Facebook, and you-name-it are able to protect your personal data much better than you are able to. They have military grade security restrictions, better backup methods, and are able to do this much cheaper.

> While this argument being absolutely true, people seem to forget that giving away your data to any third party is the root of many problems in the first place. It is not relevant to whom you are giving your data to.

>Let me explain…

So OP is arguing that this is why you can’t trust anybody not just MS. That’s a stance too, and perhaps for an incredibly security sensitive product the correct one, but definitely an impractical one for probably 98% of software products.

This would sound like ChatGPT if I didn't know better...

All of your arguments are "made up" arguments, they contradict themselves or each other or assume some very unlikely situations, especially on behalf of what the post you replied to wanted to say, where it's clear it's not what it wanted to say.

Let's dive in!

> So are you suggesting that the most practicable alternative is to be a slave

Clearly, the post you replied to doesn't suggest that. (But you went on arguing as if it did).

> a trillion dollar technology vendor is a bit bananas to me.

Nobody's killing Microsoft. But even if they were, maybe that's the right thing? You make no arguments not to.

> If you are trying to run a business, I think you are completely fucking yourself over with this sort of attitude.

The company I work for runs on Linux. The company I worked for before this runs on Linux. The company I worked for before the last one also runs on Linux. And the one before those two -- yes, you guessed it, also runs on Linux. The operating system chosen to run a business was never a serious factor in terms of whether the company succeeded or failed. By and large, it's not important.

Are there specific technologies / products only available on Windows? -- You bet! What should be done about those? -- find a way asap to not make them exclusive to that platform. One of the most tragic situations in this respect is in medicine. Windows is ubiquitous in this field. To the point that I'd say that governments should step in and invest into the healthcare they control to change the situation. I.e. to do the complete opposite of what you are suggesting.

> Microsoft is a big place.

All under the same roof, with the same objectives and strategy, which are to screw you (the "Microsoft shop") in particular, but also, if possible even those who managed to stay away from them. The problems Microsoft creates for the world aren't somehow local to one or two departments of the company. The company, no matter how big is responsible for its policies.

You said it best yourself: The operating system chosen to run a business was never a serious factor in terms of whether the company succeeded or failed.

While I don’t think that statement is universally true because for certain products OS matters, but generally, why would anybody migrate away from windows just because of a security incident? Linux has had its fair share of RCEs and 0-day exploits. Are you saying Linux is intrinsically better?

The thing is: Windows and Office is insecure by default. Admins react by sprinkling anti-virus on top of it, but that doesn't help any.

It still enables users to open random mail attachments in Office or similar. And Office doesn't have any sandboxing or other mitigation in place, again it's insecure by default. If you enable users to do stuff like this, you have noone to blame if you get owned.

Are the usual Linux distro's better? Hell no! They have the same flawed security architecture as Windows, only without any motivated attackers (yet).

But there are actually secure alternatives: QubesOS and ChromeOS.

QubesOS is probably not that suitable to end-users, they can do too much wrong to twart it's security (using the "financial" qube to browse p0rn... etc.).

ChromeOS is a reasonably secure OS: It's root filesystem is read-only with tamper-proof authentication, user's home directory is encrypted. Chrome runs with the usual privilege separation in multiple processes each in it's own tight sandbox. There is no way to autostart anything.

Even in the nuclear case of a 0-day RCE + chained sandbox breakout + privilege escalation to root, the threat can not persist itself... you just reboot the device and are save again.

And Google has lot's of experience in security, they one of the few who build their own browser, the most hostile environment. They are clearly thinking about security front and center and not as an afterthought (like Microsoft).

If those are your criteria, macOS is the better choice for businesses. Certainly not qubesos lol

> Are you saying Linux is intrinsically better?

Can we say that the market has spoken?

https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...

I look forward to the day that windows is mostly a UI over WSL and things like the regsitry become a distant memory.

The market is an illusion. Until recently I had no means to buy Linux, I was forced to buy Windows (and it is illegal here, but all you get for going to a trial is not even the price of a licence). Even today the options are very few.

The idea of a market works if it costs ~0 to enter a market, consumers have an infinite access to knowledge and infinite time to make a decision BUT make it in 1s when at the store, and also enough money so as to not be a problem. Basically, consumers have all the power and vendors have none.

Nothing is really a market, and operating systems definitely shows it.

> The idea of a market works if it costs ~0 to enter a market, consumers have an infinite access to knowledge and infinite time to make a decision BUT make it in 1s when at the store, and also enough money so as to not be a problem. Basically, consumers have all the power and vendors have none.

I keep trying to communicate this whenever people are attempting to manifest an Invisible Hand to control bad behavior. More people need to be aware of this.

I like your succinct point. I wish there was something so short and understandable for an even fuller picture. Like including that for a marked to price things in a way that works for societies, consumers need to choose long term over short term gains and that the price needs to not make economic externalities of human rights or destroying the climate.

>Until recently I had no means to buy Linux, I was forced to buy Windows

Huh, why not?

Because no computer was sold with Linux in it. There wasn't even an offer, let alone a market.

You can just install it after the fact. Do you lack internet?

Are you serioulsy implying that everyone had hundreds of MB to spare, the knowledge, the material and the time to do it ? I'm talking about the beginning of the century when the only connection was through 56k. I'm talking about being an underage kid who discovers computing, through whatever exists in the store, and you think downloading an iso is straightforward ?

You said 'until recently' but you're describing a situation from the 90s.

It's still true today, machines with Linux can barely be found in stores. You can find them online but that's not always easier for people who are not knowledgeable

It's not true today at all lol. You talked about not having access to Linux and only having dial up speed - that's strictly a 90s problem.

You don't see them in stores because there is not enough demand for them, and because stores are dying anyway. Very easy to find them online to buy.

> only having dial up speed - that's strictly a 90s problem.

Dial up was widespread well into the early 2000's, and even then ADSL started to spread slowly.

> You don't see them in stores because there is not enough demand for them

There is no demand because, again, the market is a lie. One OS is forced to consumers, on the computers they buy in the stores, they use at school, they use at work. That's exactly what I'm saying.

> Very easy to find them online to buy.

Computer literacy of the population is not comparable to the one of people on HN, so no, I wouldn't say it is as easy as buying a linux computer online than buying any computer offline.

Bro you are really arguing for the sake of arguing now.

> Dial up was widespread well into the early 2000's, and even then ADSL started to spread slowly.

Cable became common in the early 2000s, and even if you couldn't get it at home you could go somewhere that had decent speed, certainly to download a 600mb ISO.

Not bothering to address the rest of your contrarian points.

> Can we say that the market has spoken?

Microsoft aggressively abused its monopoly position in order to make sure that Linux would never win in the desktop market, and then inertia took over, so no we can't say that the market has said anything useful

Yes. In every possible way, yes.

I didn't argue for moving to Linux. My argument is that we need redundancy. If one system has a huge failure like this one -- we shouldn't find ourselves being hostages of this system.

Similarly, I'm not against Microsoft products being used in hospitals. I'm for transparency of standards, rules used by hospitals to acquire and maintain software, public interfaces, reporting...

If such rules are created and Microsoft is playing by the rules -- then I have no problem with it, but having Microsoft decide what the rules are is a disaster.

You run your own mail?

Ha.

What do principles have to do with ANY of this? Microsoft promised a level of security and didn't deliver, and is now covering up, BADLY.

The only logical solution is to start looking elsewhere, even if you can't switch right now.

YOUR cope appears absolutely delusional.

> How much business convenience are you willing to squander over these principles

I haven't seen such a clear statement of this idea in a very long time[1].

The "principles" you are trading for convenience include control of your network.

[1] Last time was a talk by Bruce Schneier, a long time back. He famously declared if you give people a choice between security and dancing pigs, they'll take the pigs every time.

If only there were an alternative software development modality in which development is distributed, source available, and modification permitted to any party, with open review and analysis for vulnerabilities, and far less capacity for lock-in.

What you're arguing is essentially the Too Big to Fail proposition. The solution of which is to Not Let Things Get That Way.

<https://en.wikipedia.org/wiki/Too_big_to_fail>

> You may be leaving a lot of upside on the table by never considering them as an option.

Maybe, but you're also avoiding a whole lot of downside. I don't think it's unreasonable to avoid Microsoft products, either as a business or as a person.

Whether or not it makes business sense to depends on your business, of course, but there are plenty of successful businesses who avoid Microsoft.

Moving off Windows or Azure or whatever probably isn't adequate.

All architectures based on certificate authorities are fundamentally fragile in the same way. People look at me like my head is spinning when I suggest just adding ephemeral self-signed CA root certs to deployment pipelines (or, god forbid, use SSH keys, or even symmetric keys).

However, those approaches have a much, much smaller attack surface than HTTPS or standard X.509 SSH authentication, so I'll keep recommending it.

I think the reason for the pushback is that, in this space, attack surface is roughly proportional to monetization potential.

I’m not sure exactly what role in what sort of deployment pipeline you’re suggesting for ephemeral root certs here, and you may well have a solid handle on how to do this safely.

But one reason I might initially look at you with alarm if you suggest self-signing or symmetric keys as part of a solution in general is… while it might reduce the attack surface, attack surface is not the only thing to worry about. Another thing to consider is the ‘fuckup surface’ of a particular architecture.

And one problem that self managed key distribution strategies tend to run into is that they massively increase your fuckup surface. Losing the keys to everything can become a real danger.

I’m a big believer in building security systems that also reduce the blast radius of dumb errors (accidentally running rm -rf /* is harmless if you religiously run with least privilege).

Saying ‘I’m going to build my own trust root’ generally seems to me like it probably increases the blast radius.

> That's exactly the problem - what ARE companies going to do? Migrate OFF windoze? Migrate out of Azure? To Linux?

The short answer is...yes.

Of course it isn't easy. Of course it would take time. But it's certainly not impossible. It's certainly been done.

I'm not defending MS but the idea that they're some sort of siren and companies can't help themeselves...well, please get me a list of those companies so we short the shocks if they're that incompetent.

Unfortunately even much of the open source world generates and distributes their official builds from Microsoft infrastructure. And even the distros themselves will get the source to do their own builds from the copies hosted on Microsoft infrastructure. So it's not a cure all if you suspect you can't trust GitHub.

It's not the first time that a company got compromised due to microsoft software. This time it was their cloud offering, the previous N times it was AD, Exchange, Outlook, WSUS (for delayed updates), ... And even if they'd move to something else they'd reach for solutions that also get their tentacles into everything because those solutions are convenient during those time windows where they're not exploited.

Wasn’t SolarWinds Microsoft software being compromised too?

When the US govt got hacked they actually did something about it government-wide. Started new security standards. For themselves and their vendors like M$

SolarWinds is the name of company that was compromised, and as far as I can tell was never owned by MS.

Right, but the question is whether SolarWinds was owned due to an MS vuln.

A quick scan of a summary of the SolarWinds story suggests that's not the case, but it's possible that the article I read glossed over too much.

> the question is whether SolarWinds was owned due to an MS vuln

No, but the other way around happened. It may be even this hack on the article, it's not very clear.

The Solar Winds thing is probably much larger than what we have been allowed to know. I do expect more of it to come out, for decades because the victims just have no way to know they have a problem.

> deserve what they get sadly

This is incredibly insensitive and dismissive, and victim-blaming.

Hard disagree. This is professional negligence. How would you feel if your doctor only prescribed medicine from one single supplier?

If the single supplier supplied the correct medicine, and it works, why worry?

Evidently it was not the correct medicine.

More like one batch was deficient and was recalled as soon as the issue was discovered.

MS discovered this years ago. And they have refused any recall.

This is also not the first time they cover up some serious problem and refuse to fix it. In fact, that's a daily activity for them. This one is just a larger problem than usual because they are broken too, not only their clients (even though, that makes it only slightly larger).

If I am reading the linked material correctly: more like a nefarious actor was able to get into the production facility and is still in there to this day. With the same false keycard that originally granted them access.

Is it? Every large company has a well compensated CTO whose job it is to think through these sorts of hypotheticals. But “nobody gets fired for choosing Microsoft”, and so the monopoly continues…

"A sound banker, alas, is not one who foresees danger and avoids it, but one who, when he is ruined, is ruined in a conventional and orthodox way along with his fellows, so that no one can really blame him"

The worst part is that very poor diversification / groupthink is exactly what creates financial bubbles and financial crises. We seem to be reaching that uncomfortable too-big-to-fail scale in computing / cyber security.

> We seem to be reaching

We clearly reached it at the 90's. We have been waiting for the other shoe to drop since then.

Other shoe will not drop because the liability for mishandling customer/user data is minimal. I don't expect a scenario where Microsoft (of even Microsoft's cloud division) folds after this. Bear Stearns actually collapsed after their fuckups.

JMK: <https://www.greatsayings.net/john-maynard-keynes-sayings/a-s...>

Some of my large enterprise clients require us to use Microsoft too, so that decision can radiate outward beyond large, conservative companies.

I joined Accenture in 2003 after over three years of onslaught of Windows e-mail Virus after Virus. They were actively transitioning away from Lotus Notes to Exchange/Outlook and migrated everyone a few months after I joined. Within weeks they were hit with Sobig, causing 100,000 employees to spend hours each dealing with it.

Several million dollars gone from one virus. But they forged ahead, entreating further with Microsoft.

Victims absolutely shouldn’t be blamed, however, you don’t buy a Pinto if you are concerned about being trapped in a fiery wreck, you don’t go to Skid Row after dark if you’re concerned about violent crime, and you don’t buy Microsoft if you’re concerned about security. These are all things we’ve known for decades.

Someone complains of getting mugged, you say something about how they brought it on themselves... victim blaming.

But if that someone hunts down the mugger, dances a jig in front of him, starts mocking, "oh come on, I have a thousand bucks cash on me, point the gun at me already"... well, telling them that they're doing it to themselves isn't victim blaming. It's objective truth, the only truth that matters.

They're doing it right now. As we speak. We're having this conversation watching them while they try to throw themselves in front of the gun. It's time to stop worrying about whether or not we're insensitive when we describe what's happening in front of our eyes.

Microsoft is slowly chipping away on-prem Exchange and AD, forcing people into their Azure/O365 offerings little by little. They advertise their Cloud offerings as being more secure.

Little by little? It was a mass lemming Exodus that jump-started back in 2014.

If it is the case that it is going to be extremely risky to run of MS supplied infrastructure (including Windows) we should see insurance premiums sky-rocket for companies and organisations using those platforms. Eventually, it will become cheaper to migrate off the MS platforms.

This is mixed with an ever increasing legislative push and higher fines for leaking PII.

This already seems to be happening overall, though I can't quite find vendor specific data.

e.g.: https://www.cnbc.com/2022/10/11/companies-are-finding-it-har...

And just recently Sharepoint was found to accept alg: null JWT tokens (ie. complete authentication bypass)

You also have things like mimikatz - which is only a thing because Windows just stores user's passwords in plaintext in lsass memory -, pathetically weak hashes, pass the hash etc.

Catastrophically-bad-by-design authentication is a Microsoft staple.

Do you have a link to a cve or vuln report? I’d like to read more

https://starlabs.sg/blog/2023/09-sharepoint-pre-auth-rce-cha...

> own ways to do anything but be a slave to Microsoft

I guarantee 99/100 humans on this forum either currently host with AWS/GCP/Azure or have worked at a shop that does. And I bet an outsized portion of those AWS/GCP shops also host on Azure for Azure AD.

There is no one that is ready for a de-Microsofted world. Even Linux distros have been increasing their support for integrating into the MS ecosystem and forsaking alternatives because how prevalent AD is. Even the most prominent alternative FreeIPA is designed to compliment an AD installation, not replace it. The best supported directory/central login server on Linux is AD.

My entire adult life and career has been MS free. It’s not that rare.

MS is still probably somewhere in the supply chain of software you use.

They have contributed to the Linux Kernel, they own GitHub and NPM, they make an extremely popular editor, among other things.

It’s a different set of risks than depending on them directly, but they’re still there.

Contributing to something and owning it are wildly different levels of control. The rest of it is reasonable, but Linux doesn't belong in your list.

Fair point.

It's not that rare for developers and sys admins. It's pretty rare outside of that, particularly if you're on a corporate-managed system. Wander down to HR or finance or legal and see how many *nix systems you see.

I think ours have macs

Your whole office? Like sure whatever, I don't use Windows but that doesn't count. The IT directory server is Azure AD and is the SSO for everything non-dev related Slack/JIRA/the office VPN.

I did work at google for 15 years and sun before that

I wanted to believe the same, until I thought about the Tax Office and, basically, the entirety of my government, who happen to not be USA but is definitely a Microsoft place.

What's wrong with openldap? I mean, apart from being a pita, i thought it was the widely used central auth directory (behind all sorts of sso frontends).

I maintain a small openldap directory for our company and I think it's great. The main problems revolve around being somewhat old-fashioned and not intuitive for modern tech workers. I'm the only one in my org that really knows anything about it. Management software for openldap definitely has room for improvement, and documentation could be improved as well. It works great though! Super fast and flexible.

Yes indeed! When i said it's a pita, i mostly meant that LDAP is a pita (needlessly complex spec with complicated query language and the whole schema extension zoo). openldap is pretty fine as far as it can be.

Personally i'm using lldap, which is a neat no-footgun ldap daemon for small/personal deployments.

The concept of Microsoft-y admins supposedly unable to work with other tools is insane. There is not much in common between let's say Windows and MS365. Even within MS365 the integration between various tools is often not seemless and when you start using powershell admin common there are completely random differences between the way you login, plus where some features are implemented is also completely random (e.g. tons of non email things in exchange, at least accessed through the exchange ps connector)

If an admin is able to navigate in all that shit, I don't know why they would not understand e.g. random unix tools.

> Certainly not, Microsoft-y admin only know Microsoft, they usually can't do much else, it's all they know.

I am a linux sysadmin. Honest question: Would I have an edge on a Microsoft-y admin or are linux sysadmin skillset limited to Linux ? I can find my way around a lot of network appliances (sophos, cisco, junyper, etc.) and I'd expect a windows system to be as capable.

For my smaller clients, I have been migrating them to Synology Directory Services (LDAP/DNS/SAMBA)... I import AD, switch the DNS on the workstations, good to go.

Test it out, if curious - Pretty straight-forward. And a heck of a lot more economical.

Blatent case of Microsoft derangement syndrome.

Hard to take your comments seriously with such obvious disdain against the company and ridiculous victim blaming.

Can you instead adress the Op’s concerns rather than calling names?

This is exactly the same attitude people got to Web3. So many scam tokens and rugpulls, they’re like “what are you gonna do? it’s the wild west.” Worse than that, when Celsius, FTX and other centralized companies imploded due to unsustainable and negligent practices many people were led to conflate that with Web3 blockchain smart contracts ecosystem.

The ironic part is that Bitcoin and Ethereum, altcoins like Filecoin and the entire space of decentralized protocols (EVM, the coming-soon FVM, etc) was designed to eliminate centralized middlemen, including banking cartels, Amazon (which is being sued for monopolistic practices) and the soon-to-come CBDCs etc. In fact, all the responsible protocols (IPFS, UniSwap on Ethereum, Aave marketplace etc etc.) kept humming along regardless of bull and bear markets. It’s just distributed code!

But middlemen were able to convince the public that their centralized companies “ARE web3” and then overpromised yields and other crap.And now the public conflates that with all decentralized protocols that carry value — that’s why we can’t have nice things.

And a bunch of fly-by-night teams cloned contracts delivering no utility at all and some even put backdoors in them. Like PHP “give me the spaghetti codes” crowd and Javascript script kiddies and HTML personal sites with <blink> tags script kiddies… but with some money invested.

Cryptographers were right to protest the word “crypto” being associated with this.

You are spot on with this; you don't need distributed systems and cryptography to run a fraudulent bank! Indeed, much of the 'trust' that comes with traditional financial institutions comes not from an inherent advantage in competence compared to cryptocurrency developers, but the fact that most national governments will bail out bank failures and reimburse vast sums of their citizens' losses.

If cryptocurrency-based financial instruments were regulated and protected to the same degree as traditional companies - but with the relevent technical competence to match! - I'm sure 'pay with ETH' and the like would be as common as PayPal and VISA.

Another reason I am in love with LLMs. You don’t need to know the software like the back of your hand - a new environment is like a new programming language, as long as you’re able to ask the right questions new environments will be far more accessible. Experienced admins should know the requirements, and not be limited to the tools.

Migrating will be relatively cheap. No wonder they’re hobbling the tools (/tinfoil), they see the threat.

I'm not so convinced a LLM remixing all the tutorial blogs its ingested is a meaningful quality step above those tutorial blogs themselves.

Earlier this year we had a linux task that was above the normal complexity my team deals with. So a few people threw it at chatgpt and were amazed at how good the results were. In reality, it was full of outright factual inaccuracies and non-breaking bad decisions. But their skill ceiling prevented them from seeing how bad the output was.

I didn't want to be a wet blanket, so I let them have their fun and quietly guided the jr working on the resolution through an appropriate implementation.

You should point out to all of them now what the consequences would have been of blindly following the LLM. It's an important lesson they can and should learn from.

Nah dog, I'm good. I'm not young, eager and naive anymore. "Growing the team's skills" and "working towards company goals" are siren calls. I know how to swim in my own lane.

My experience with LLMs is that they distill just the group think from the internet, and remove all rational thought.

I doubt they'll be much help doing anything that is better than whatever standard practice was 6-12 months ago.

If anything, I'd expect them to cement in incumbents and bad practices, since fewer people will be reading documentation and thinking critically about how to do better.

Reply on news.ycombinator.com