this post was submitted on 13 Jun 2024
1 points (100.0% liked)

Technology

59651 readers
2617 users here now

This is a most excellent place for technology news and articles.


Our Rules


  1. Follow the lemmy.world rules.
  2. Only tech related content.
  3. Be excellent to each another!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, to ask if your bot can be added please contact us.
  9. Check for duplicates before posting, duplicates may be removed

Approved Bots


founded 1 year ago
MODERATORS
 

Microsoft is pivoting its company culture to make security a top priority, President Brad Smith testified to Congress on Thursday, promising that security will be "more important even than the company’s work on artificial intelligence."

Satya Nadella, Microsoft's CEO, "has taken on the responsibility personally to serve as the senior executive with overall accountability for Microsoft’s security," Smith told Congress.

His testimony comes after Microsoft admitted that it could have taken steps to prevent two aggressive nation-state cyberattacks from China and Russia.

According to Microsoft whistleblower Andrew Harris, Microsoft spent years ignoring a vulnerability while he proposed fixes to the "security nightmare." Instead, Microsoft feared it might lose its government contract by warning about the bug and allegedly downplayed the problem, choosing profits over security, ProPublica reported.

This apparent negligence led to one of the largest cyberattacks in US history, and officials' sensitive data was compromised due to Microsoft's security failures. The China-linked hackers stole 60,000 US State Department emails, Reuters reported. And several federal agencies were hit, giving attackers access to sensitive government information, including data from the National Nuclear Security Administration and the National Institutes of Health, ProPublica reported. Even Microsoft itself was breached, with a Russian group accessing senior staff emails this year, including their "correspondence with government officials," Reuters reported.

top 50 comments
sorted by: hot top controversial new old
[–] _sideffect@lemmy.world 0 points 5 months ago (1 children)

Ms has always been a shitty company, from the time it was formed

load more comments (1 replies)
[–] RickRussell_CA@lemmy.world 0 points 5 months ago

Satya Nadella, Microsoft’s CEO, “has taken on the responsibility personally to serve as the senior executive with overall accountability for Microsoft’s security,”

Err. Wasn't that already true? He's chief executive officer, not chief some shit that doesn't include security officer.

[–] Bonesince1997@lemmy.world 0 points 5 months ago

Oh no. How will I know where I'm going without copilot?!

[–] Taleya@aussie.zone 0 points 5 months ago* (last edited 5 months ago) (1 children)

the funniest part of the fall of MS for me has been the cunts getting so excited about fucking off the home users they forgot one vital thing: C-suite and beancounters run at a home user level. And most infrastructure techs will happily flick to a linux distro come server build time.

Their current direction has also pretty much killed their use in anything related to media distribution, it's virtually a detailed list of TPN violations

load more comments (1 replies)
[–] Gullible@sh.itjust.works 0 points 5 months ago

Why lie about this, Microsoft? Your PR team sucks.

[–] FergleFFergleson@infosec.pub 0 points 5 months ago (1 children)

This statement, from the company that looked at Recall and collectively said "yeah, this is a good idea".

[–] demizerone@lemmy.world 0 points 5 months ago* (last edited 5 months ago) (1 children)

Well recall is why they're so focused on security now. They want to host every detail of your life. They can't do that now because their platform is a tire fire.

[–] AbidanYre@lemmy.world 0 points 5 months ago (2 children)

their platform is a tire fire.

Always has been

[–] Lost_My_Mind@lemmy.world 0 points 5 months ago (6 children)

Eh.....Windows 3.1, 95, 98SE, XP, and 7 were all pretty great.

They HAVE released some hot trash. I don't even remember Vista. I just remember it's trash.

[–] dgriffith@aussie.zone 0 points 5 months ago (2 children)

Eh.....Windows 3.1, 95, 98SE, XP, and 7 were all pretty great.

From a user interface perspective, they were okay, perhaps because by the time people got to XP they'd had a decade of a consistent interface and were just used to its quirks.

From a security context they were not ok. Not ok at all.

load more comments (2 replies)
[–] trolololol@lemmy.world 0 points 5 months ago

Nope, always garbage. It did get worse with vista and 11 though

load more comments (4 replies)
load more comments (1 replies)
[–] Tylerdurdon@lemmy.world 0 points 5 months ago* (last edited 5 months ago) (1 children)

"Microsoft is pivoting its company culture to make security a top priority..."

The fact that this had to be stated is a testament to garbage leadership. Notice it's not even the top priority, just a top priority. These guys will still get bonuses of course.

load more comments (1 replies)
[–] xenomor@lemmy.world 0 points 5 months ago

My suggestion, based on more than three decades of observing and interacting with this company: don’t believe a fucking thing they say, ever.

[–] reversebananimals@lemmy.world 0 points 5 months ago (5 children)

To reinforce the shift in company culture toward "empowering and rewarding every employee to find security issues, report them," and "help fix them," Smith said that Nadella sent an email out to all staff urging that security should always remain top of mind.

Yeah that ought to do it.

[–] Emotet@slrpnk.net 0 points 5 months ago

Same energy as "You have unlimited PTO here, but we also have this nifty little thing called performance metrics"

[–] schizo@forum.uncomfortable.business 0 points 5 months ago (1 children)

That's just barely thoughts-and-prayers level. They could at least schedule a mandatory meeting that interrupts everyone's day for half an hour.

[–] Serinus@lemmy.world 0 points 5 months ago (2 children)

Usually they set up a hotline which may or may not get you fired.

[–] herrcaptain@lemmy.ca 0 points 5 months ago

Using the hotline won't get you fired, but somehow - for totally unrelated reasons - after using it you'll end up on a PIP with untenable goals, and that will get you fired.

load more comments (1 replies)
[–] Cosmos7349@lemmy.world 0 points 5 months ago

"Of course, fixing these kinds of issues won't push your product deadlines back at all. But we'll be thankful to you! "

[–] WhatAmLemmy@lemmy.world 0 points 5 months ago

Lol. Considering it was senior management that ignored staff, this statement is even fucking dumber than it sounds.

[–] Semi_Hemi_Demigod@lemmy.world 0 points 5 months ago (1 children)

"Next week to improve employee morale we will have a pizza party" - Nadella, probably

[–] rem26_art@fedia.io 0 points 5 months ago

they could throw a pizza party for their government clients. Less work than fixing the problem

[–] 555@lemmy.world 0 points 5 months ago (1 children)

Too late, my office just switched to Linux.

[–] Lost_My_Mind@lemmy.world 0 points 5 months ago

..........what? What kind of office do you work in that understands linux??? Most offices I've worked in don't even understand the copier.

[–] Hobbes_Dent@lemmy.world 0 points 5 months ago

Rough month for reflection at M$. Possibly finally took it too far with users via Recall and - quite a feat here - showed Microsoft in a negative light for another big solidified base in government.

[–] TWeaK@lemm.ee 0 points 5 months ago

Microsoft is pivoting its company culture to make security a top priority

Didn't they already do that a decade or two ago??

[–] aphonefriend@lemmy.dbzer0.com 0 points 5 months ago (1 children)

Look at this smug assholes face. He knows damn well they won't be doing anything of the sort unless it increases their profit margins. And he also knows damn well the government won't do anything to seriously hinder their margins.

Bread and circuses. This is just another show. You want change? Stop using Microsoft. Period.

[–] Maeve@sh.itjust.works 0 points 5 months ago

That's all week and good for the minority of jobs that didn't cling to it like a codependent partner.

[–] kippinitreal@lemmy.world 0 points 5 months ago* (last edited 5 months ago) (2 children)

Microsoft focused on security at this point is like a builder focusing on building strong foundations now that the house is built on top.

It's a little too late my dudes.

[–] Tinidril@midwest.social 0 points 5 months ago

I remember them saying all the same exact things in the early 2000s after a slew of widespread disasters. Security will never be a higher priority than whatever cool new thing they want to sell.

[–] Maeve@sh.itjust.works 0 points 5 months ago (3 children)

It would take ripping apart and rewriting hundreds of thousands of lines of source code, if not millions. Not just bloat from one off bright ideas, that led to the next bright ideas, but the deliberate obsfucation to protect proprietary code, in more instances than I can imagine. I'm not a programmer, so I could be wrong, obviously, but from my admittedly limited perspective, they'd be better off writing a whole new OS without all the built-in garbage nobody wants.

load more comments (3 replies)
[–] tabular@lemmy.world 0 points 5 months ago (2 children)

Pick one:

  • security
  • proprietary OS
[–] Cosmos7349@lemmy.world 0 points 5 months ago

I mean what they have to do is obvious, right? Only one of these two options can help increase ad revenue.

[–] Dudewitbow@lemmy.zip 0 points 5 months ago (3 children)

you can have a propietary os thats secure, but the problem is once you get to the point where youre selling data and allow anything to be installed of course, its no longer secure.

[–] tabular@lemmy.world 0 points 5 months ago (2 children)

You can't verify it's secure if it's proprietary, so it's never secure? Having control over other people's computing creates bad incentives to gain at your users expense, so it's day 1 you should lose trust.

[–] fuckwit_mcbumcrumble@lemmy.dbzer0.com 0 points 5 months ago (1 children)

You can have audits done on proprietary software. Just because the public can't see it doesn't mean nobody else can.

[–] tabular@lemmy.world 0 points 5 months ago (1 children)

That just moves requiring trust from the 1st party to 2nd or 3rd party. Unreasonable trust.

[–] fuckwit_mcbumcrumble@lemmy.dbzer0.com 0 points 5 months ago (2 children)

Do you yourself actually audit the software you use, or do you just trust what others say?

[–] tabular@lemmy.world 0 points 5 months ago* (last edited 5 months ago) (2 children)

This is like asking if you do scientific experiments yourself or do you trust others' results. I distrust private prejudice and trust public, verifiable evidence that's survived peer review.

[–] TropicalDingdong@lemmy.world 0 points 5 months ago* (last edited 5 months ago) (1 children)

Scientists in the room who have to base their experiments off other peoples data and results:

Tongue in cheek but this is actually giving me particular headache because of some results (not mine) that should have never been published.

[–] tabular@lemmy.world 0 points 5 months ago

That sucks, but the answer to bad results is still more/better tests 😇

[–] fuckwit_mcbumcrumble@lemmy.dbzer0.com 0 points 5 months ago (2 children)

If you're a big enough organization (like the US government) you can pay anyone you want (or even your own people) to audit Microsoft's code.

[–] tabular@lemmy.world 0 points 5 months ago* (last edited 5 months ago)

If I'm a government I'm hella criminalising the sharing of proprietary software.

[–] dfeldman@hachyderm.io 0 points 5 months ago

@fuckwit_mcbumcrumble @tabular I’ve never worked at Microsoft, but I worked at a different enterprise company and they did indeed fly in representatives of different governments who got free access to the code on a company laptop in a conference room to look for any back doors. I always thought it was silly because it is impossible to read all the code.

[–] circuscritic@lemmy.ca 0 points 5 months ago

Wait....you don't audit every package and dependency before you compile and install?

That's crazy risky my man.

Me? I know security and actually take it seriously. I'm actually almost done with my audit should be ready to finally boot Fedora 8 within the next 6-8 months.

[–] Dudewitbow@lemmy.zip 0 points 5 months ago* (last edited 5 months ago) (3 children)

id argue arguing the unknown can't be used to say if its technically secure, nor insecure. If that kind of coding is brought into place, then say any OS using non open source hardware is insecure because the VHDL/Verilog code is not verifiable.

Unless everyone running an open source version of RISC-V code or a FPGA for their hardware, its a game of goalposts on where someone puts said flag.

load more comments (3 replies)
[–] tengkuizdihar@programming.dev 0 points 5 months ago (1 children)

Sure its secure, but is it verifiably secure?

[–] TORFdot0@lemmy.world 0 points 5 months ago (1 children)

I mean you can provide audit findings and results and it’s a pretty big part of vendor management and due diligence but at some point you have to accept risk in using open source software that can be susceptible to supply chain hacks, might be poorly maintained, etc or accept the risk of taking the closed source company’s documentation at face value (and that can also be poorly maintained and susceptible to supply chain attacks)

There’s got to be some level of risk tolerance to do business and open source doesn’t actually reduce risk. But it can at least reduce enshittification

[–] cybersandwich@lemmy.world 0 points 5 months ago (3 children)

It's pretty hilarious when people act like being open source means it's "more secure". It can be, but it's absolutely not guaranteed. The xz debacle comes to mind.

There are tons of bugs in open source software. Linux has had its fair share.

load more comments (3 replies)
load more comments (1 replies)
load more comments
view more: next ›