ocdtrekkie

> support hotline

Have you... ever tried talking to Microsoft support?

Entra ID is separate if you don't want logins from Nigeria. One of the most insane-to-me things is Office 365 is basically "open access by default" and you have to pay $6/month/user to fix it. Most people don't realize just how much attack surface they open up moving their data to the cloud, and that it costs a lot to even start to get back towards a secure environment like you had on-premise.

But yeah, the lock-in effect is huge. Microsoft cloud products deliberately don't work well with anything but more of their own cloud products. And as soon as you start a migration to it based on what you need, you suddenly realize how much other stuff you also need to pay them for. And you can't escape without replacing all of it.

Yeah though FWIW, the overall impact of companies realizing maybe they shouldn't be spending $100k a year on a document editor is likely to raise all boats for alternatives.

It remains really wild people think Office is worth $30/month/user. Anything that erodes that belief is a net positive.

Indeed, and they control the CA/B Forum. The last CA to express an independent and reasonable view got booted from being a trusted CA.

Well, that is the nature of security theater. Busywork and process fragility with no or negative benefit.

In the past a long-lived EV certificate changing was notable/interesting from a security standpoint. Short-lived certificates just mean anyone who can break into your domain registrar (easy) can create an identical certificate and none of your key storage or security matters.

It will merely mean any given legitimate certificate is indistinguishable from a newly minted malicious one.

Because the people on the CA/B Forum is doing security theater and doesn't have a practical view of security risks. But the tech companies that employ them view them as authorities and won't fire them for promoting dumb ideas.

The CA/B is the embodiment of the phrase "if all you have is a hammer, everything looks like a nail".

In theory it can be shorter. Imagine good.cooking is shorter than goodcooking.com

But every one of these plays with all sorts of collisions of user expectations. "word.cloud.microsoft" is one of those URLs that will never look right to me, but is now a corporate staple.

I think more modern security is an "emperor has no clothes" situation than people think. The LLMs are gonna have a field day.

They probably will be the one going through their parents stuff and hopefully by the time its an issue can move it to their kids' place. Options for trusted free hosting are limited sometimes. ;)

100% everything here. That level of tamper evidence should be good enough for the reasonable individual, IMHO.

On the enterprise scale, the question I think everyone should be asking is: Do they have LTO tapes on a shelf? Fundamentally the same issue (but larger), in terms of needing to ensure it's physically separate, and secure, and tamper evident. =)

Anything in the cloud or connected to your network can be hacked. The backup of last resort must be on a shelf.

If you think this is historical, you have a lot to learn about production servers in the wild! =)

Just as a not-insignificant portion of the world still relies on a handful of ancient AS/400 systems, a pretty big portion of society depends on the good running of hand-configured Windows Server.

This is true in tech as well. Big Tech folks with figuratively infinite budgets believe they're all that, but they basically are incapable of understanding the day to day problems small organizations face, or develop the ability to jump between completely different fields of technical problems several times a day.

Larger organizations come with more specialization and greater resources, but you will never find a jack of all trades there.

If they solely look for and record sightings of specific plates associated with active investigations? Not a lot, no.

The core problem with Flock is that it tracks innocent citizens on the off chance it helps catch a criminal, when it could be designed to only track already known wanted vehicles.

There is a meaningful value in catching stolen vehicles and child abductors. Not high enough to justify capturing every single plate, but there's a value.

Bear in mind this is not meaningfully different than previous mechanisms of issuing BOLOs. Law enforcement widely distributes information about plates of interest. In my area, those plates are often on digital billboards already.

Well the average kidney transplant works for 15-20 years... so probably not.

Yeah that stood out to me too. It feels like they should be putting veteran pilots with newer ones so that you gain experience while having it in the cockpit already.

I've been on iOS for like seven years and have never done this. But... hey, it works!

Yeah, dismissing a question I don't see an answer for right now easily is the worst. I think swiping the app closed is the easiest way out.

Entra has already had vulnerabilities where a user in one tenant could access global admin of every other tenant. Somehow everyone didn't immediately move off Microsoft's cloud platforms.

Physical security vendors usually stop exactly there. I can't count how many vendors responsible for badge systems shut off the Windows Firewall just because it’s easier than adding a rule.

Significant improvement on the old name, it no longer sounds inherently obsolete when you say it.

Pro tip for sump pumps: Get a float switch instead of a liquid sensor. That tells you if the water level is too high or not, not if the sensor is wet.

- You want to know this before water is on the floor.

- Sump pits tend to be splashy in heavy water flow.

- The float switch will correctly return to "it's fine" status when the problem is no longer occurring.

Liquid sensors are great for "my basement is flooding", float switches are great for "I need to fix my pumps before my basement floods.

Quality placement, no notes. I saw this comment before reading the article, still clicked it and felt got.

The unfortunate reality is this is why we have residential botnets. Your friend is probably paying for his free TV by attacking things over the Internet.

Everything can stack onto everything else, sure. Most people's SAML IdPs are... synced from their LDAP. =) But in particular SAML provides an SSO experience where signing in once in the browser will allow you to go to various integrated sites and apps without signing in again. That flow is not dissimilar from OIDC but it is separate. So I can have 10 apps with SAML and 1 with OIDC, and the OIDC one is gonna be an odd duck.

And a key aspect that modern setups often forget: Every single different UI your users see makes them easier to phish. One of the reasons Entra is so easily phishable is Microsoft uses like 500 different domains for their cloud platform, so the one in the mix they don't actually own isn't obvious to the average user.

It's outdated in the way that the author doesn't like it, but SAML will probably outlive OIDC.

As a SaaS customer, interacting with SaaS vendors tends to entail:

1. Finding out a company wants several grand to flip the "allow SAML" switch on the tenant config, and a few thousand a year in additional licensing to leave it on. (I had a vendor both tell me it "takes five minutes" to get it set up, and then quote me $4,800 to "implement" it.)

2. Having to yell at the SaaS vendor for routing the identity connection between two or three other identity providers in different various clouds because, you know "modern stuff". (A vendor I am working with has not less than five different accounts to access various parts of their infrastructure, none of which are connected at all. I assume people there listened to "switch to OIDC" nonsense, completed half the job, and now have OIDC sites and SAML sites forever.)

3. Discovering the SaaS vendor knows how Entra works, how Okta works, and how Google auth works, and having no idea how SAML works. Or OIDC or anything else for that matter.

4. Eventually finding an engineer far enough from the sales and implementation teams who can answer how the product actually works. :D This point is reached after a lot of yelling.

Entra is just allowing the Chinese government in your environment. Why bother with authentication at all?

https://www.war.gov/News/News-Stories/Article/Article/428899... (Microsoft has solely discontinued this practice for the DoD tier. Commercial, GCC, and GCC High are still impacted because foreign labor is cheaper than the risk to your security.)

Eh, if you don't have SAML support, I can find a product that does. Not a problem. \o/

(Or to be more clear, it is mostly unacceptable for an enterprise product to have opinionated decisions about what authentication it works with. You either work with what we use or you are not viable as a product for our need. It's kinda simple. I would expect someone whose authentication was OIDC-based to be similarly dismissive if you told them you only would do SAML.)