Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

Market pressures dominate nuclear weapons development?

In any case, Exchange is not just email, it has Calendaring/Contacts stuff going on as well.

Try managing a calendar or booking resources.

It's a serious post, unfortunately.

Every company I worked for before or since just used IMAP.

Note that MX records are misleading here. They have no false positives, but are full of false negatives --- daisy-chaining MTAs is common, and since Microsoft owns the mailbox, it's invariably last in the chain. So the MX record will show something like Proofpoint (pphosted) or Mimecast or an internal company host, when really it's Microsoft in the end.

My direct employer uses GSuite (and Google docs as a source of record is as bad as a 2000s file share)

Mid-sized businesses (100-1000 employees): around 60-70%

Small businesses: more variable, maybe 40-60%

this reply was written by “AI” :)

Like, if a fighter jet pilot came and told all American jets are equally weak and overcomplicated and ineffective, it probably tells more about that pilot than about the jets.

I don't know if that's the case, but that would be the idea.

My work laptop is Windows, and the only native applications I run on it are a web browser, Zoom, and the company's VPN software. Everything else runs inside WSL.

I greatly prefer Debian to Homebrew, so if I can't run actual Linux, this is (to me) superior to trying to develop on a Mac.

Not in my industry. And workstations, mobile or otherwise, on the clock? You work with what's certified and available. But to be fair, "Apple people", praise the Great Maker, are utterly irrelevant here. Hardware- and software-wise.

OP doesn't like working for people that have bad tools mandated by the company. He uses a proxy measure to determine this beforehand.

The other poster had problems with people like OP because they don't use the (bad) tools provided by the company.

It doesn't sound wrong from either side. It's actually a win-win for both if they don't meet, which would mean OPs strategy is great for both. It might preclude OP from some opportunities though if the filter is too wide.

I personally do think that if you mandate the wrong tools you will never get the best developers, because great developers are very picky about the tools they use. It can be a bit too extreme in some cases, but I've rarely seen anybody that is good at this job and not very opinionated in some way or the other.

In most cases the problem is mandating though, if you give recommendation but allow deviations from that recommendation within reason you can usually get everybody to be happy.

For example, if OP for some reason stops liking a maintainer of, say, RabbitMQ or PostgreSQL, they might be penetrant about switching a finished project to a different stack without any tangible reason, causing completely unnecessary headaches for the team.

Says it's unthinkably bad then proceeds to give only one example. There are several other issues you can list.

>the terminal -- the terminal! -- freezes after staying open several days, and you need to kill it and restart it.

I wonder when that issue ever happened since I'm always ssh'd into my homelab via the terminal for days and never had to restart it since it never froze.

>The worst part, I think, is how the brokenness ends up permeating the engineering culture. Malfunction is just normalized.

Microsoft didn't make the culture like that, the managers were always like that which made them choose Microsoft because they just choose the biggest corporate name brand supplier. It's your typical old-school MBA.

I've worked at all-MS shops and at all-Linux shops, and despite the issues with MS tech, the all-MS shops were far less toxic and pleasant to work at as people treated it as a 9-5 job instead of their own personal start-up project that needs to strictly conform to their world view, therefore the linux-shops I worked at tended to attract more of the toxic problem employees like your grandparent whos work life revolved around tech evangelism than pragmatism, which I didn't like since I just wanted to get work done and go home, not participate in some crusade at work to judge and shame choices of OS/IDE/languages/frameworks/tools the company should be using. As long as I get paid, I'll use any widely available tool, I don't really care.

If they're also making you use Outlook or especially Teams then they're going to start losing "points".

Also yes, due to availability and various other reasons, H1bs, particularly from India, seem more likely to use a MSFT stack.

“Nobody ever got fired for choosing MSFT” goes hand in hand with “if we don’t exploit the H1B system to get cheap coders who won’t sue us or try to organize then someone else will.”

Using FOSS, hiring citizens, treating employees well, actually innovating and producing great products, all hang together. Sadly, such companies and people are increasingly rare in tech, because the tech oligarchs fund bad people and bad products because they are often greedy egoists whose wealth is derived from being in the right place at the right time, or from what I call “moral arbitrage” (doing things others are too ethical to consider) rather than deriving wealth from actual talent or ingenuity. Ymmv

"yes, your car exploded, but you were driving on a dirt drive way. it works just fine on the highway"

It's pretty much the majority of their Linux users. Firefox is often the default browser on many distros due to the Chrome/Chromium data sharing concern.

> * Your organization is too small for them to care

Then why even have a business tier if not for the support?

The result of Microsoft's current stance is simply that users look elsewhere. I mentioned Overleaf, but Google Docs is also a solid choice. For local editing we are using LibreOffice.

I remember years ago there was a browser demo, some kind of game I think, that would only be played on Internet Explorer. If you changed your User Agent string to be Internet Explorer, the demo would work entirely without issue. I think this was prior to Microsoft getting a large fine for not offering other browser choices.

> >Sorry for that we may have no enough resources about the Linux environment.

That is a difficult to parse sentence. "may" indicates uncertainty about the claim about to be made. "have no enough resources" seems to indicate that there is not enough engineering time available. "about the Linux environment" seems to indicate that it is a knowledge gap. Very strange.

If a file server breaks basic Unix tools it should be unplugged and put in the garbage.

I've no idea how to find the "proper" way into the system.

Vendors can be accountable without providing source code, for example through contracts specifying performance.

I don't know how large Sharepoint's source is, though it has many components and I assume there is quite a bit of code. Auditing the source code of something like Microsoft Office seems almost impossible.

> first principles.

What does that mean in this context?

Not having internet access at all is like not having your building connected to public roads. That makes it harder (but not impossible) for bad guys to come, but it is so much of a hassle that almost no one does that. Instead, they use gates and checkpoints.

Same idea for internet access. They have internet access, but they have security systems, from traditional firewalls and VPNs to airgaps.

Security is about letting the good guys in while keeping the bad guys out, the latter is meaningless without the former. That's why security is hard, if is was just about blocking everything, it would be easy, but nothing would be done.

The web though I agree isn't very decentralized.

Nothing wrong with it being in house. But having a back-up is never bad.

> How is remote any more responsive than physical workers being in-house?

If the on-site workers are incapacitated. It's a remote (hehe) risk. But so is foreign hackers doing anything with our nukes.

> If power-plants operated efficiently back in the 50's without internet, they should be able to now without internet

If you're fine paying 50s power prices again, sure, I'm sure a power company would happily run their plants retro style.

But that is very geography dependant.

> What happens if you connect Windows XP to the Internet in 2024?

https://youtu.be/6uSVVCmOH5w

For hiring and retaining people, yes. It's understood that the "guts" of what's happening at these facilities needs to be locked down to the max. But, for supporting roles you need to be able to bring people in off the street without 1) a bunch of specialized training on your bespoke way of doing things, and 2) making your employees less attractive on the job market.

Just my opinion, though. Maybe I'm completely off base but it doesn't seem like a good idea to me long-term.

Also, the Kansas City Plant is like a watchmaker's factory, not a power plant. They make widgets and gewgaws, not literally split atoms.

https://en.wikipedia.org/wiki/Operation_Olympic_Games#Histor...

> Dutch engineer Erik van Sabben allegedly infiltrated the Natanz nuclear facility on behalf of Dutch intelligence and installed equipment infected with Stuxnet. He died two weeks after the Stuxnet attack at age 36 in an apparent single-vehicle motorcycle accident in Dubai.

https://en.wikipedia.org/wiki/Erik_van_Sabben

This article is full of nonsense and speculation.

It's an answer from talking heads, not from people from the facility.

The root fault with this article, and the resulting discussion, is the extent to which it generalizes over one of the larger organizations in a very complex part of the defense industrial complex. Many parts of KCNSC's operations are absolutely not exposed by this incident. Other parts absolutely are. Determining which fall into which category, and to what extent that is acceptable, keeps quite a few people employed.