Hacker News Reader

Comment by wumeow | Hacker News Reader

Microsoft’s security failures are a threat to national security. Microsoft itself is not.

Anything used will become a target. How the hell is MS a bigger threat than the rest? If anything a lot of the industry is a way bigger threat and spends less on security.

I don’t understand your comment. Microsofts failures are a threat precisely because it is so used, especially by the US govt. And they may spend a lot on security, but their recent failures have been pretty amateurish. A recent breach they had was due to an old, non-2fa service account with a weak password and privileged access. See also the CISA report about last years breach.

> but their recent failures have been pretty amateurish

> See also the CISA report about last years breach

The same CISA who just recently got hacked in an even more amateurish way?

https://news.ycombinator.com/item?id=40107675

https://securityintelligence.com/news/cisa-hackers-key-syste...

Knowing and doing are separate skills.

And if it were ten open-source projects then they'd have to defend themselves against nation-state attackers. They're not ready for it. The researchers that demonstrated an attack on Linux got vilified instead of the maintainers that had misplaced their trust. *Researchers* not a truly sophisticated and a well-funded threat actor. Do you see the issue?

Do you really think the alternatives are more diligent with their defense, 2FA, have spent as much time and effort on security?

I truly don't like Microsoft but this seems like shitting on them but I really don't see the point. Anything they use is going to be a "national security threat." I'd gladly see other vendors stepping up, but it's enormously difficult and we're not really there yet.

> And if it were ten open-source projects […]

The alternative wouldn’t be to use a smattering of open-source stuff, it would be to go with a different cloud provider like AWS or Google.

> Do you really think the alternatives are more diligent […]

That’s what the CISA report suggested.

I’m not shitting on MS, I just don’t want foreign adversaries to be able to pick apart our IT systems like vultures.

But AWS alternatives ARE just a smattering of open source stuff.

Getting everything into AWS doesn't solve anything by itself, either. Then they'd still need to get everything off of windows, office, exchange, AD, etc. etc. Which is a ridiculous amount of work and they'd be fighting bugs and issues for years and years at their scale.

Depends on your nation maybe, but if you are anything but American, it is definitely a threat to your national security.

As much as I like ragging on the softies--and lol my good sir--it's the existence of power that is a threat. The current captain, or their whims, or our belief in them, they are a sense only and no guarantee.

Reply on news.ycombinator.com