Hacker News Reader

Comment by throwoutway | Hacker News Reader

Yesterday ProPublica and ArsTechnica published a takedown of Azure: "Federal cyber experts called Microsoft’s cloud a “pile of shit,” approved it anyway" ...

https://arstechnica.com/information-technology/2026/03/feder...

View on HN

In which one expert called the documentation provided "a pile of shit", which propublica took the liberty of extending to Azure itself

And they weren’t wrong

They still lied, because they didn't say "X is shit" but "Z said that X is shit", however Z apparently never said that.

I have become very cautious of such stories for this very reason. Who gets how much blame has a lot to do with "culture" or momentum. Bashing Microsoft for example is always super fine, but at multiple occasions I found the facts to be much more nuanced.

If a slop engine calls a slop company slop, has anyone really lost?

We lost, for one of us got tricked to bring it here.

In this case, it’s just yet another design-level vulnerability in Microsoft cloud’s services. There isn’t much room for nuance.

It's true, they lied. But, paradoxically, in this case, while they lied about details, the conclusion is still true: Azure is very far from AWS and GCP as far as security is concerned. I have my own suspicions why it is so, but the reasons are not important, what counts is the final conclusion: if you really care for security, you'd better chose one of the other two.

“Fake but accurate.”

ProPublica has an agenda, and they slant their reporting to push it.

You can like their agenda and support this effort, but it’s not journalism.

What is their agenda?

Compare 600+ stories tagged for the Trump administration:

https://www.propublica.org/topics/trump-administration

…with 16(!!) since 2020 on Biden’s term:

https://www.propublica.org/topics/biden-administration

My favorite missing Biden story that should have been right in their wheelhouse: The unprecedented $36 billion bailout of the Teamsters’ pension fund.

https://www.statesman.com/story/news/politics/politifact/202...

Well, yeah, their agenda is reporting on fraud and illegal actions. If you do more fraud or illegal actions, you will have more stories about you. Trump does more fraud and illegal actions, objectively. If you’re a Trump supporter, reality may make you sad and angry when in conflict with the mental model.

I don’t mind pension bailouts, compared to tax cuts for the very wealthy and unnecessary military action in the Middle East (which has cost ~$50B as of this comment). Compare the costs.

Here’s an article on their front page today on a few thousand dollars in campaign contributions, no allegations of fraud or anything illegal:

https://www.propublica.org/article/sean-duffy-michael-alfons...

The Teamsters bailout was something like a million times that, from a Democratic president to a critical Democratic constituency.

Teamsters members in a majority voted for Trump. Google it. Biden helped people who didn’t value it. You blame Biden for “buying support” when it didn’t help Democrats; he did it because it was the right thing to do to protect the retirement promises made to union workers.

Can’t fix uneducated, unsophisticated voters I suppose.

https://www.theguardian.com/us-news/2024/sep/18/election-tea...

https://www.currentaffairs.org/news/sean-obrien-sold-labor-t...

I’m not arguing the merits of the policy. I’m arguing that if the Big Beautiful Bill contained a $70B slush fund for the administration to hand out to its tech buddies, ProPublica would have gone wall to wall.

Titles are editorialised and space limited. The first couple lines in the article linked above make the nuance pretty clear.

[edit: 'pretty' instead of 'perfectly']

You are defending not just clickbait, but libelous clickbait.

It's only libelous if it's not true. This vulnerability says otherwise.

It is libelous because it is a claim that "X said Y", not "Y".

Ah, so you're worried about the review team being misrepresented, not that Azure is shit.

I doubt this reaches the bar for libel by a long shot.

In those types of reviews/audits, documentation is the first indicator of whether a security organization has their act together. It's about building a trust relationship between the accreditor and contractor that will have to endure for years, as nation-state level actors throw their resources at finding vulnerabilities. MS couldn't do this or couldn't be bothered to do this. So shit documentation -> shit security processes and operations -> shit security -> shit cloud product in a government context. So the title wasn't that much of a stretch.

Every security engineer I know working at Azure is on the verge of self-harm because of the current situation, or is the dumbest IC I've ever met and somebody I think should have never become a security engineer. Sample size ~12.

That is quite the indictment.

I am not very close with every one of these engineers, and some no longer work at MSFT, but yes talking to employees in Seattle working on security made me never want to use Azure.

Last I heard, the CO+I org has some pretty serious cultural problems that contribute to this, and which will not be easily solved.

Ars just republished it under license

Bloomberg and CNBC don't seem to have reported about this, maybe someone with contacts could make them aware?

Reply on news.ycombinator.com