intern4tional

This isn't secret news, but when you interview at MS there is always a secret / hidden interviewer. This is publicly known information from Cracking the Coding interview. This person is called the as appropriate and you only meet them if you pass all the prior interviews.

Per his writeup, he did not meet that person, which means that he most likely did not pass the interview.

He also for some reason didn't follow up on the results of the interview for 6 months, which is unique as most candidates will reach out. Assuming he actually filled out a job requisition, which he probably did to interview, he also should have gotten status from that requisition, so things are a little fishy.

I do not know anything about his case directly, but I would bet that he did not pass the interview and a decision was made to not bring him on as a result.

If Microsoft was trolling him to just pick his brain, they would have done more than two small events, and wouldn't have bothered to reach out to tell him they were releasing a product.

This response also burns any bridges that he had built with the team. He could have still potentially made something of his product if he had kept that relationship open and used his leverage as an existing package manager owner to influence WinGet.

If I was him, I would have at a minimum asked for feedback far earlier than wait for 6 months.

Am Microsoft.

Mountains were moved to make it scale, but that has been achieved. Semmle can scale with work - it just takes a lot of effort and code.

I'd be curious as to why you think that. Are you able to provide more detail on that claim? I have extensive experience with Semmle and my experience drastically differs from you.

With certain languages and a strong and diverse ruleset Semmle has it's strengths. In particular with native code (C, C++) and decent rules I have seen Semmle be very successful at finding certain classes of bugs.

Correct, this is a net new release. Right now it's a little rough with lots of pieces missing, but once it's all out there it should have benefit.

An example would be if any performance enhancements can be ported to other C++ implementations.

For MS, an edge case is something that probably has under 100k users unless someone on the dev / feature team decides to champion that item.

So no - some of your examples are very much edge cases, preference, or lack of understanding how MS works.

Example(s) off your list: item #4 - that's subjective and I am certain there are users that do want that feature. This same feedback probably applies to #3 also. Or not enough people care / complain about #2 and #3 to get them prioritized.

#5 and 6 is probably because people tend to think that MS is one unified company; it's more like little ones that group together to produce a product. The Excel and PowerPoint teams pre-Satya wouldn't have even talked on features outside of integration testing. That item also might be a PowerPoint issue, a Windows OS issue (for how the formatting gets preserved on copy) and not related to Excel at all.

The VBA item someone else has already addressed.

MS dogfoods heavily; it's just that MS doesn't represent their user base (hence the push for insiders - as insiders may represent the user base). I think most large companies (Google, Amazon, etc) that make software have that same issue (lack of user base representation internally).

No, they just don't use it for your specific scenario.

Disclaimer: Work at MS. We use Excel plenty, we just tend to do things differently than many other businesses as things that shouldn't be done in Excel we don't do in Excel (since we have other tooling available).

The challenge is that in reality, people are diverse and will use Excel as long as they can as they don't want to buy other software, lack skills to implement it differently, or for some other reason need to keep data in Excel.

Software like Excel has been around for so long and has so many edge cases in how it is used that the dev teams could spend 100% of their time adding features and still probably not touch some potentially large user base ones.

They don't need 20 years of anything; they simply needed a change in leadership, which they got.

Satya is drastically changing the culture and with it the business. I get there are people out there that will always have an ax to grind (you seem to be one of those) but if you wait 20 years to trust a business again, you'll be left behind with any improvements or optimizations that happen in the meantime.

If Microsoft sustains its direction for a few more years at most, given the pace at which the industry they are in evolves, the legacy practices they had won't much matter.

Microsoft employees are not like Googlers. There was a protest letter that was passed around and I think it got more ex-MSFT than actual employees to sign it.

I suspect a few people from both companies will complain but it won't be enough to dictate change. MSFT employees complained about the company working with ICE and while that did get a response, it didn't get the contract canceled.

This story is just a summary of: https://www.theverge.com/2019/4/9/18301736/slack-microsoft-o...

It also contains less information as it makes it seem like Slack and O365 are collaborating when they are not.

tl;dr: "Microsoft has shown in the past that it’s willing to partner with rivals like Dropbox, but Slack’s Office 365 integration was created using public APIs and with no special help from Microsoft. This Slack integration comes just months after Microsoft launched its free version of Teams to rival Slack, just weeks after the company unveiled creative new conference call features for its Slack competitor." (from the Verge article)

Not necessarily.

Instagram knows that people password spray its service regularly and that many popular accounts are often targeted for takeover by scammers. This is a common problem for them and happens regularly They also know what those threat actors do once they get an account.

I'm betting this scenario isn't one they see happening after an account is compromised or is easy to detect etc, and for those reasons the risk is different. How likely a vulnerability is to be exploited plays an important part in deciding the risk it carries.

You should include the fact that you work at Google (cause you do, and your response is not completely honest without that disclaimer).

The parent's concern was that this is Google focused, and your response doesn't seem to disprove it in any way.

Regardless of what happens, thank you for trying to make the web a better place.

This article has:

- No technical details

- Is not timely (issue is resolved)

- Reads like a poorly written hit piece

- Could be summarized by a tweet: 2FA outage in Azure impacts cloud hosted services. Issue is now resolved.

Issuing an apology will do squat.

The people that oppose Microsoft aren't asking for one, they're asking for changes to other things so the apology is moot. Microsoft is far from perfect, but they're possibly the only one of the big 4 that is at least trending in the right direction.

I mean I could provide statistical data and show trends etc, but that's a lot of effort. I am presuming that people here will have kept up on major breaches to realize that point. That might be a really bad assumption but I know there are some really smart infosec people on hacker news.

Yes, social events do not always follow the same pattern (see Trump election), but the odds in this case are very much on the side of Facebook's breach being the same as others before it.

Not the parent but:

Technical details I cannot think of anything off the top of my head; my issues would be with his motivations. He ascribes things to malice that could be easily attributed (and rightfully should be) to incompetence or out of touch with the customer.

I think that's kind of the entire idea. Microsoft is expecting people to use the IP in the patents to write code for Linux now without fear of being sued.

When they donated the IP to OIN, for all intensive purposes the patents were liberated given OIN's wide coverage.

I've seen several similar threads to this one on Twitter.

"Blah happened at Facebook and it is potentially a company ending event."

This causes me to almost immediately discredit them, as while serious, this is no where near a company ending event for an organization that is headquartered in the US.

Equifax lost the personal data of all Americans and is doing fine.

Facebook might get fined a metric ton of money, people in some portions of the world might leave it, but the company will be just fine. You see, there is no where else for those people to go. Presumably they're on Facebook for some reason so they would want to find an alternative and there isn't an alternative that is as easy to use that their friends and family will migrate to.

Like many other compromises, this one will be forgotten. There is no wordlist that will come out of it, no public artifact that will exist. People have already forgotten about Adobe, LinkedIn is fading, and this one will eventually join their ranks.

Developing UWP apps is challenging though, it's not a straightforward experience and as a result many people hate it.

I don't know if you've ever had to debug a UWP app but compared to almost anything else it's painful. Exceptions don't propagate properly, and finding errors takes a ton of time. Development is likewise painful with elements of random things being required and the packaging and publishing process a nightmare compared to competitors.

UWP was made for phone and Microsoft then ported it to Core OS, but as a format it is not developer friendly. If you look at new Microsoft under Satya - and their goal of being developer friendly, this move makes sense. I wouldn't be surprised to see UWP and the current store deprecated entirely (as they are honestly failures).

AWS has had these same issues when it has had region outages.

Simply google AWS outage and see the results. Thankfully an entire datacenter outage is rare and Azure is taking steps to mitigate that risk.

Examples please? You're just making some unsubstantiated claim.

Eventually all divisions roll up to the same executive team. The level at which Windows and the people responsible for this decision meet is far above where the decision is or was made.

Mobile and XBOX aren't subsidiary companies. Mobile rolls up closer to Windows than the browser team does which led to the mess that is UWP and the Windows 8 (and on) start menu.

Sorry, your comment is inaccurate.

More importantly, the charge only happens after Windows 7 has reached end of life.

They did the same thing with XP, and any enterprise software company does this for end of life software. If you want support on an EOL product, it's not free.

The article jumps to conclusions -> saying this will cause problems with Windows 10, which is not yet EOL. This article is more or less flamebait.

The linked trial testimony says otherwise. The engineer states he found bugs, and theoretically it might be possible he was unable to reproduce. Further, he evaluated the software against his own coding standard which was a variant of another.

The engineer was questioned:

" Q. Now, you have not reproduced in vehicle testing your 25 theory that there's a software bug that opens the THIS TRANSCRIPT IS NOT PROOFREAD 30 1 throttle and then the task dies, have you? 2 A. No."

From page 245. Further reproduction questions were all answered with a no further.

To get a successfully task death failure (what the engineer wanted to happen) the engineer had to modify the source code.

Further in the limited testing even with modifications, the failsafe triggered 100% of the time.

Your statement is incorrect.

Every big company has a forensics / investigations team. This team will interface with law enforcement as necessary.

This is common.

Microsoft is well aware that things can be spoofed, and has a very talented threat intelligence organization that would not make this claim without substantial proof.

This includes things like encryption keys and other non-public identifiers. Should those items be made public, the adversary they are combatting would then roll those indicators and leave Microsoft blind. This isn't unique to Microsoft either, most security / threat intelligence companies have their own swath of private signatures.

The sites reporting on this are aware of that issue (non-public signatures) and as such do not need to offer a disclaimer. Microsoft is the one making the claim and they have the reputation to back it up. Unless there are solid reasons to question Microsoft's work there is no need to include your unlikely scenario.

I disagree with your statement. I would say that given current events and the coverage of them you are seeing Russia more that other entities.

This happens for a variety of reasons, some technical, some political. The technical ones are when indicators for an active APT group are released it becomes easier for others in the industry to see them and to catch them or report on their activity. This results in that group having more attention in the media as firms publish their findings.

The prior US administration took the step of sharing many of those indicators with the industry and so the Russians are getting caught more often.

This has happened before. Remember the 'Aurora' incident that Google had around 2010? That time frame from 2006-2014 the Chinese were dominating the news for this sort of espionage.

In short, I think that we are simply catching the Russians more often right now as they haven't had time to retool or cover their tracks and there are active defensive campaigns targeting their teams. Obviously other countries have an interest (including the US - remember the Vault7 leaks?). As an example, there was an article on HN just recently about how the Chinese rolled up the CIA network in their country via a compromise of the CIA's messaging system.

As far as hiring Russians, the specific groups that firms like Microsoft track are ones composed of government entities (hence the article notes 'Hackers linked to Russian government entities..'). They are not generally hirable by third parties.

Agreed, this probably doesn't belong on Hacker News.

This sounds eerily similar to "Extend, Embrace, Extinguish".

Only in Google's case, they capture the market fully and then kill it rather than leave it running the captive portal.

Minecraft, LinkedIn as examples. While LinkedIn has not gone super well, it has been left to make the decisions that it made on it's own.

Minecraft has also gone untouched - it's still hosted on AWS in fact.