Anti-trust settlements and legislation, along with regulation as a result of those do dictate multi-browser support for some things.
Microsoft and in particular Windows is heavily regulated.
470 karma · joined July 4, 2015
I am a senior staff software security engineer.
Microsoft and in particular Windows is heavily regulated.
Different development teams have different attestation requirements. My team did not require commits to be attested via yubikey when I was there, although I know at least one team that had that requirement.
It was an internal team specific requirement though and one of their own choosing (meaning they imposed it on themselves).
A few other things:
- Azure DevOps is public, you can see it or try it out here: https://azure.microsoft.com/en-us/products/devops
- Internally at MS, stuff is dogfooded on dev / test / pre-production builds so things are broken often. Think like being on Windows Insider constantly only its even earlier in development (canary releases or other trial branches).
- MS doesn't require you to use a specific browser internally. IIRC the internal standards actually require internal sites to support Firefox, as there are places in the world where MS has employees where Firefox usage must be supported.
The USA, technologically and manpower wise is doing fine at the moment in addressing these external threats.
There isn't any "letting it run" here, there is does Microsoft want to backport this feature to Windows 10? There are challenges with that as the hardware support is much more varied for Windows 10 than 11 and so there are impacts to consider ranging from the weaker hardware requirements for 10 to how these things are integrated in with the OS.
Source: I worked at MS, on the OS codebase in security.
Kinect / XBOX is much simpler than this as the hardware was at least known and standardized.
Users I do not recommend due to botting: bmingus
Woven Planet Cyber and Vehicle Security | All levels | Full Time | US and Japan
The Cyber and Vehicle Security division at Woven Planet has a variety of roles open in the US (generally west coast based) and Tokyo, Japan (relocation included). (Other areas are hiring too, but I can only comment on the Cyber and Vehicle Security group.)
Woven Planet is on a mission to make the most programmable cars on the planet, what this means is that we're developing what you might consider a car operating system. Teams are small and well resourced. Working from home is an option regardless of where you are based.
Job's link: https://jobs.lever.co/woven-planet?department=Cyber%20%26%20...
Tech stack: C++, Autosar AP, Linux, and a variety of RTOS.
Email me at <<removed>> if interested or if you have questions.
Change happens slowly. This is a small step in the right direction.
MS also competes with GitHub also; Azure Repos are a thing, as is Azure DevOps and those are just two examples. MS has plenty of products that compete with each other.
In some spaces this is a good strategy as you will capture more market share with two products than you will with one and you can avoid to an extent monopoly claims.
GitHub Codespaces is what killed Atom and while MS was probably involved in the decision to develop Codespaces, the decision to sunset Atom likely wasn't explicitly made at that time; its simply a side affect as other things have eclipsed Atom.
Even MS's own recruiters will use LinkedIn to contact current MS employees for internal positions.
Tech is a double sided coin. Things like this have the power to be abused, even easily at times, but that doesn't mean they always will be.
The jobs are located in Japan and Woven Planet does offer relocation. We do virtual work part time (most people work from home 2-3 days a week).
I am the hiring manager for the following vehicle security positions.
https://jobs.lever.co/woven-planet/fa6cc69a-2fee-46ff-adf4-7...
https://jobs.lever.co/woven-planet/3703d60a-c637-420f-a11a-f...
Woven-Planet has a reputation for an inconsistent process when it comes to hiring, but that problem is resolved for security positions. Woven-Planet is building the next generation of a smart city, next generation of mobility services, and programmable vehicles. Basically, this means you'll be deep in C++ code, doing cutting edge things.
You may contact me at caleb[dot]mcgary[at]woven-planet[dot]global if you have questions or are interested. Please put HN: Referral in your subject line.
That is not the case, its best thought of as a batch of little companies that band together to create a product. These companies may compete for resources and attention internally and so each one will optimize for their own benefit.
Ads in Edge? That's probably a decision made by some Principal Program Manager with director support on the browser team. The metrics that get tracked for that event are likely how many people click through the ad, rather than the over all impact to the OS.
The OS Core team doesn't have the influence to say no, or stop the browser from showing those ads. I recall internally when I (a paying customer for O365) got a toast (that is what a popup ad is called internally) for O365 and I decided to raise an issue.
Some PM II (mid-level PM was running the campaign, and they were showing metrics that more people signed up for O365 as a result of the campaign, so per them it was good. I was not in that organization and since that director had OKRs that required signups, he told me to go away.
The core OS stripped down has none of these things, but at integrated build, lots of stuff gets put in, and when one team says no to something, often another one will say yes. A good example is that Office has its own update infrastructure and tooling outside of Windows Update. Why? Office wanted to deliver updates on weekly basis and Windows Update said no as that would be too impacting for users, so Office simply said ok and built their own.
These issues rarely if ever get surfaced to an executive, as by the time the metrics get up to a CVP generally they are showing broader trends, like adoption, or game breaking bugs, or as you note, the line going up. Executives do not get these problems (such as inconsistent UI) to them. Those things rarely rise above a Group PM or Engineering Manager level, and those people often do not care about the complaint as for that metric helps them or is part of their strategy.
Windows, the product team cannot do anything about it due to political problems internally at MS and that is not the engineering team behind Window's fault. We (as that was a team I was on) hated when a product team would do something obnoxious and if we could catch it prior to release would often bluntly complain. More often than not we would get told that we were the platform and to stay out of the other teams business.
Anyways, there isn't some mass company dark pattern strategy or other conspiracy, just a bunch of little factions that are all optimizing for their own interests. Office is probably the worst offender of the batch (Skype, Teams, OneDrive) and Windows can do little about it.
If anything, the reason feedback took forever to him was because someone may have asked for an exception to the interview failure so they could hire him. Large companies are behemoths and things do go wrong, mistakes are made, and Microsoft did own up to it in this case (https://devblogs.microsoft.com/commandline/winget-install-le...) but open source did not play a part in it.
Source: myself, I worked at Microsoft in a past life and did many interviews. No one cares about someone's stance on open source anymore.
If the police had at all reached out in an official capacity Microsoft would have assisted.
Source: was employed at MS and know they take such things seriously.
You may want to follow up with whatever officer you talked to.
Most of the top tier people that I know in cyber security are not certified professionals, but rather people that have deep knowledge in their area of expertise with the ability to apply security knowledge to it.
The list of certifications is bad because:
- it only focuses on offensive security work, which is a small part of the actual field (there is the entire blue side as an example)
- it focuses heavily on the software side of the house which is once again not the entire field (more than a few places have been popped due to infrastructure misconfigurations and issues)
- it ignores many common enterprise environments that use things like Active Directory, Otka, EUA, SSO, etc. These are things that you will encounter and must know how to work with or secure if you are a generalist in the field (if you're specialized you may never touch these things at all).
In short, this is good if you want to be a consultant doing generic penetration testing but not much more than that. They may also serve as HR checkboxes for recruiters that do not understand the job requirements.
During an active incident, attribution details are not published. This incident still has people responding to it, and potentially further impacted victims. Indicators of compromise are published to allow for entities to hunt for malware or evidence of breach within their environments, but details that directly attribute a particular strain of malware to a threat actor are generally not shared (at least with the general public). Publishing those details could cause the threat actor to change those details and therefore evade detection and persist in impacted environments.
Let's take the Google breach of 2009, known as Operation Aurora as an example (https://en.wikipedia.org/wiki/Operation_Aurora). China was claimed to be the culprit at the time, but it was not until three years later that Fireeye / Mandiant finally published the details that were used to track and identify the threat actor as part of their APT1 report (https://www.fireeye.com/blog/threat-research/2013/02/mandian...).
In this particular case, even though the known impacted entity count is around 250, around 18 thousand entities downloaded the backdoored version of SolarWinds and are at risk. Publishing attribution details now could negatively impact their response. When respected entities in the field make a claim on attribution, generally it is accepted as if those entities were lying, their service (and potentially some of their executives as they are publicly traded in some cases) would go to jail.
It's important to note that each responding team will have access to different data sources and be able to make different claims as a result. CrowdStrike declined to do attribution, whereas FireEye was more definitive with naming a group. This is likely as FireEye was impacted first hand and was able to capture indicators that are not public. (One of the steps of IR is containment, where you observe a threat actors activity to figure out where they are in your environment, so you literally get to watch them some.)
The people in charge of the various government agencies are politicians without experience in this area true, but they are briefed and educated by the experts that do have experience in that space. Likewise, Washington Post is known for vetting stories in this space carefully. At this stage in the game, it is highly unlikely it is not Russia, as this sales pitch is very similar to when Russian associated actors leaked the NSA toolset. It too was advertised for sale via bitcoin (https://en.wikipedia.org/wiki/The_Shadow_Brokers).
Anyways, if you're interested in this space, go find your local incident response (DFIR) meetup and ask how they track malware families. IP addresses are probably not one of their best signals for who made malware or executed an attack.
Windows source is open to most people at MS. MS is not joking when it says we practice an "inner source" policy, in that we do not rely on the security of our source code to secure our products.
Attackers have been able to compromise major environments regardless of OS type. Windows having a larger market share is clearly going to have more compromises, but other OS based environments are just as prone to compromise. There also have been major incidents with standalone applications that are OS agnostic.
Heartbleed is a great example of an OS agnostic flaw that was used for major attacks. As noted earlier while the OS does play an issue, its more than likely just correlation rather than causation due to Microsoft having a dominant position in the market.
Reference: https://en.wikipedia.org/wiki/Heartbleed#Exploitation
Releasing attribution evidence right now will not happen as that would intrude on the response. Instead you will get signatures for specific pieces of malware or generalized yara rules to look for indicators of compromise. The specific indicator that allowed for attribution may never be released as then this particular adversary could work around it.
FireEye is a reputable security organization that is publicly traded. If they were lying and it was discovered as a company their business would go away rapidly and some of their executives might even go to prison. If you have legitimate evidence that casts doubt on their statements please share it. Finding something that significant would shake up the industry.
Attribution is most likely a combination of evidence and forensic data collected both from the initial breach (SolarWinds) and other breached entities. Things like how data was exfiltrated and to where to who purchased and setup the domain names, any other malware that was loaded (was it signed, compiled, contain a certificate, etc).
While Snowden did reveal interesting things, there is zero basis to support anything other than a Russian state actor at this time.
As for why the attackers did not proceed, resourcing probably had nothing to do with it and more along the lines of many of those customers were not interesting. Proceeding to load further malware stages in those uninteresting customers increases the chance of getting detected and given that the attacker was targeting long term persistent access to highly valuable targets, the attacker by design more likely simply left targets without valuable information alone.
Example: "Russia, we now know, used SolarWinds' hacked program to infiltrate at least 18,000 government and private networks. The data within these networks, user IDs, passwords, financial records, source code, you name it, can be presumed now to be in the hands of Russian intelligence agents."
Reality from the linked source: "The breach is far broader than first believed. Initial estimates were that Russia sent its probes only into a few dozen of the 18,000 government and private networks they gained access to when they inserted code into network management software made by a Texas company named SolarWinds. But as businesses like Amazon and Microsoft that provide cloud services dig deeper for evidence, it now appears Russia exploited multiple layers of the supply chain to gain access to as many as 250 networks."
There's a big difference between 250 and 18000.
Further it claims that the source code access is significant. As noted in this thread: https://news.ycombinator.com/item?id=25599210 all major Governments have had read access to the source code for Microsoft products for years.
The hack is extremely serious and for that reason it merits accurate claims, response, and technical actions. Fearmongering like this article does to push an opinion piece is not it.
tplacek's point isn't that source is worse than disassembler output, it's that governments already have and have had access to source for a while (by design as Microsoft does provide source access to many customers, partners, etc). The tooling to dissemble built versions and craft exploits has also existed for a long while.
If source access enabled a rash of zero days, that point in time would have come long in the past.
Attribution is hard, but those two companies have a solid reputation and do not make BS claims.
Companies have and will ship products with outdated or unsupported OS if they think they can harden them acceptably. See all the networking devices that run some variant of the Linux 2.x kernel that still appear on the market today as an example.
Embedded XP was also a thing and probably still is in many places.
Wikipedia notes it as a design issue: https://en.wikipedia.org/wiki/Trijet
There are documented cases where failure of the central engine has caused a loss of the rear stabilizer. This can be resolved via additional engineering -> which increases cost of manufacturing and maintenance (which as you note was the main factor in why they went away).
You don't see people flying in trijets anymore as they are dangerous, likewise you don't want to encourage or incentivize people to use or build products on an insecure OS.
Sympathy doesn't matter in the business world, costs do. No normal company is going to undertake a legal review of an unsupported product; it simply isn't worth it.
In the US, economic espionage is illegal and has been for some time, with legislation reinforcing that rule (such as the Economic Espionage act of 1996). If I as a private company engage in economic espionage I am liable to get prosecuted and may get time in prison. The same does not apply to companies in China, where economic espionage of a competitor is not only tolerated but encouraged.
The above linked suit was against individuals for economic espionage and not intelligence collection.
Most of the companies when those joint ventures were setup were promised or told that their intellectual property was secure. It was then stolen and they were left with regret. Companies which refused to take that risk were compromised by Chinese actors and had their IP taken by force.
For many years the US has had to stop IP theft from China: (example: https://www.justice.gov/opa/pr/us-charges-five-chinese-milit...) and this is simply a cumulation of those efforts.
The blame on China is more than fair.