from Stopthatgirl7@lemmy.world to technology@lemmy.world on 13 Jun 23:02
https://lemmy.world/post/16499584
Microsoft is pivoting its company culture to make security a top priority, President Brad Smith testified to Congress on Thursday, promising that security will be “more important even than the company’s work on artificial intelligence.”
Satya Nadella, Microsoft’s CEO, “has taken on the responsibility personally to serve as the senior executive with overall accountability for Microsoft’s security,” Smith told Congress.
His testimony comes after Microsoft admitted that it could have taken steps to prevent two aggressive nation-state cyberattacks from China and Russia.
According to Microsoft whistleblower Andrew Harris, Microsoft spent years ignoring a vulnerability while he proposed fixes to the “security nightmare.” Instead, Microsoft feared it might lose its government contract by warning about the bug and allegedly downplayed the problem, choosing profits over security, ProPublica reported.
This apparent negligence led to one of the largest cyberattacks in US history, and officials’ sensitive data was compromised due to Microsoft’s security failures. The China-linked hackers stole 60,000 US State Department emails, Reuters reported. And several federal agencies were hit, giving attackers access to sensitive government information, including data from the National Nuclear Security Administration and the National Institutes of Health, ProPublica reported. Even Microsoft itself was breached, with a Russian group accessing senior staff emails this year, including their “correspondence with government officials,” Reuters reported.
threaded - newest
Pick one:
I mean what they have to do is obvious, right? Only one of these two options can help increase ad revenue.
you can have a propietary os thats secure, but the problem is once you get to the point where youre selling data and allow anything to be installed of course, its no longer secure.
You can’t verify it’s secure if it’s proprietary, so it’s never secure? Having control over other people’s computing creates bad incentives to gain at your user’s expense, so it’s day 1 you should lose trust.
id argue arguing the unknown can’t be used to say if its technically secure, nor insecure. If that kind of coding is brought into place, then say any OS using non open source hardware is insecure because the VHDL/Verilog code is not verifiable.
Unless everyone running an open source version of RISC-V code or a FPGA for their hardware, its a game of goalposts on where someone puts said flag.
Consider people counting paper votes in an election. Multiple political parties are motivated by their own self interests to watch the counting to prevent each other faking votes. That is a security feature and without it then the validity of the election has a critical unknown making it very sussy.
An OS using proprietary software is like as an electronic voting machine, we pretend it’s secure to feel better about a failing we can’t change.
the problem is the bad actors have direct access to said voting machines. in the case of security, the people creating the OS is not the bad actor typically in question when you think of bad actors, which kind of goes back to the goalpost situation. Unless you knew how everything is designed from the ground up (including the hardware code in whatever language it is) then thats just setting an arbitrary goalpost. basically typical NSA backdoor, or foreign backdoor via hardware situation, independent of the OS. To bluntly place it only at the OS stage is setting said goalpost there when you can really apply it to any part of the line (the chip design, the hardware assembler, the os designer, the software maker). Setting it at the OS level fundamentally means all OS’ are insecure by nature unless you’re actively running it on a FPGA thats constantly getting updates.
For instance, any CPU with speculative programming fundamentally is insecure and is virtually in all modern processors. never even mind the CPU when the door is already open regardless of the OS.
When I think of bad actors and software I think of security from 3rd parties after the intentions of the authors. Not just security but also privacy and any other anti-features users wouldn’t want. That applies to the OS, apps or drivers. Hardware indeed has concerns like software, which is just a wider conversation about security, which is just part of user/consumer rights.
Security is in degrees. The highest level would indeed use open-source hardware. I hope to build a rig like that someday.
You can have audits done on proprietary software. Just because the public can’t see it doesn’t mean nobody else can.
That just moves requiring trust from the 1st party to 2nd or 3rd party. Unreasonable trust.
Do you yourself actually audit the software you use, or do you just trust what others say?
This is like asking if you do scientific experiments yourself or do you trust others’ results. I distrust private prejudice and trust public, verifiable evidence that’s survived peer review.
If you’re a big enough organization (like the US government) you can pay anyone you want (or even your own people) to audit Microsoft’s code.
@fuckwit_mcbumcrumble @tabular I’ve never worked at Microsoft, but I worked at a different enterprise company and they did indeed fly in representatives of different governments who got free access to the code on a company laptop in a conference room to look for any back doors. I always thought it was silly because it is impossible to read all the code.
If I’m a government I’m hella criminalising the sharing of proprietary software.
Scientists in the room who have to base their experiments off other peoples data and results:
<img alt="" src="https://lemmy.world/pictrs/image/4a263582-8041-4f4c-8202-4c8a06b2403b.png">
Tongue in cheek but this is actually giving me particular headache because of some results (not mine) that should have never been published.
That sucks, but the answer to bad results is still more/better tests 😇
Wait…you don’t audit every package and dependency before you compile and install?
That’s crazy risky my man.
Me? I know security and take it seriously, unlike some people here. I’m actually almost done with my audit and should be ready to finally boot Fedora 8 within the next 6-8 months.
Sure its secure, but is it verifiably secure?
I mean you can provide audit findings and results and it’s a pretty big part of vendor management and due diligence but at some point you have to accept risk in using open source software that can be susceptible to supply chain hacks, might be poorly maintained, etc or accept the risk of taking the closed source company’s documentation at face value (and that can also be poorly maintained and susceptible to supply chain attacks)
There’s got to be some level of risk tolerance to do business and open source doesn’t actually reduce risk. But it can at least reduce enshittification
It’s pretty hilarious when people act like being open source means it’s “more secure”. It can be, but it’s absolutely not guaranteed. The xz debacle comes to mind.
There are tons of bugs in open source software. Linux has had its fair share.
The XZ thing is actually a great point to open source’s favor. All it took was some dude to figure it out.
If you try to inject maligned code, you will be found out. That can’t happen with proprietary software.
It highlighted some pretty glaring weaknesses in OSS as well. Over worked maintainers, unvetted contributers, etc etc.
The XZ thing seems like we got “lucky” more than anything. But that type of attack may have been successful already or in progress elsewhere. It’s not like people are auditing every line of every open source tool/library. It takes really talented devs and researchers to truly audit code.
I mean, I certainly couldn’t do it for anything semi advanced, super clever, or obfuscated the way the XZ thing was.
But I agree, that the fact we could audit it at all is a plus. The flip side is: an unvetted bad actor was able to publish these changes because of the nature of open source. I’m not saying bad actors can’t weasel their way into Microsoft, but that’s a much higher bar in terms of vetting.
The difference is proprietary software has to be caught being insecure to be “guilty of being insecure” while open source software has the potential to be publically verified to a degree that it’s effectively “proven innocent”.
That’s the crux of it here. Microsoft wanted to get into the data game they saw Facebook and Google reaping. However, Microsoft still charge you for the software they use to harvest your data.
the funniest part of the fall of MS for me has been the cunts getting so excited about fucking off the home users they forgot one vital thing: C-suite and beancounters run at a home user level. And most infrastructure techs will happily flick to a linux distro come server build time.
Their current direction has also pretty much killed their use in anything related to media distribution, it’s virtually a detailed list of TPN violations
Eh, that’s actually kind of a selling point. I’ve got no interest in an OS on my personal PC that focuses on being made more friendly to the MPA.
Yeah that ought to do it.
Lol. Considering it was senior management that ignored staff, this statement is even fucking dumber than it sounds.
That’s just barely thoughts-and-prayers level. They could at least schedule a mandatory meeting that interrupts everyone’s day for half an hour.
Usually they set up a hotline which may or may not get you fired.
Using the hotline won’t get you fired, but somehow - for totally unrelated reasons - after using it you’ll end up on a PIP with untenable goals, and that will get you fired.
Happy cake day!
Same energy as “You have unlimited PTO here, but we also have this nifty little thing called performance metrics”
“Next week to improve employee morale we will have a pizza party” - Nadella, probably
they could throw a pizza party for their government clients. Less work than fixing the problem
"Of course, fixing these kinds of issues won’t push your product deadlines back at all. But we’ll be thankful to you! "
Oh no. How will I know where I’m going without copilot?!
Ms has always been a shitty company, from the time it was formed
It wasn’t even Bill’s software iirc.
Why lie about this, Microsoft? Your PR team sucks.
The fact that this had to be stated is a testament to garbage leadership. Notice it’s not even the top priority, just a top priority. These guys will still get bonuses of course.
The security will definitely also take a very profitable shape. I.e. further locking the OS away from the user, more black box software, etc.
Too late, my office just switched to Linux.
…what? What kind of office do you work in that understands linux??? Most offices I’ve worked in don’t even understand the copier.
Software.
Err. Wasn’t that already true? He’s chief executive officer, not chief some shit that doesn’t include security officer.
My suggestion, based on more than three decades of observing and interacting with this company: don’t believe a fucking thing they say, ever.
Rough month for reflection at M$. Possibly finally took it too far with users via Recall and - quite a feat here - showed Microsoft in a negative light for another big solidified base in government.
This statement, from the company that looked at Recall and collectively said “yeah, this is a good idea”.
Well recall is why they’re so focused on security now. They want to host every detail of your life. They can’t do that now because their platform is a tire fire.
Always has been
Eh…Windows 3.1, 95, 98SE, XP, and 7 were all pretty great.
They HAVE released some hot trash. I don’t even remember Vista. I just remember it’s trash.
Nope, always garbage. It did get worse with vista and 11 though
From a user interface perspective, they were okay, perhaps because by the time people got to XP they’d had a decade of a consistent interface and were just used to its quirks.
From a security context they were not ok. Not ok at all.
I genuinely don’t know if I left my firewall on or off the last time I fiddled with it, on my Windows 7 machine.
That was like 10 years ago. It’s still my daily use pc. Zero antivirus. Just firefox which was installed 10 years ago. And ad block orgin which was also installed 10 years ago but updated over the years.
Oddly enough, the only website I have issue with is lemmy.
There’s security people retching around the world and they’re not sure why.
Was it 95 that you could hit cancel at the log in screen and it would let you skip putting in a password?
Sure it looked pretty, but security was a disaster.
In 98 you could use the accessibility settings in the login page to bypass account password too!
I just pressed cancel. Who needs network shares.
On XP you could start the On Screen Keyboard, open the help for that and then open the explorer by browsing for a different help file.
MS has a history of security first.
Oh, lemmy has cakes. Happy cake day.
That password was only for network shares/NT domains. 95 didn’t have any concept of users, like DOS.
Happy cake day!
Microsoft focused on security at this point is like a builder focusing on building strong foundations now that the house is built on top.
It’s a little too late my dudes.
It would take ripping apart and rewriting hundreds of thousands of lines of source code, if not millions. Not just bloat from one off bright ideas, that led to the next bright ideas, but the deliberate obsfucation to protect proprietary code, in more instances than I can imagine. I’m not a programmer, so I could be wrong, obviously, but from my admittedly limited perspective, they’d be better off writing a whole new OS without all the built-in garbage nobody wants.
I think Windows 11 was supposed to be that clean break. They’ve reimplemented a lot of core functionality compared to XP & 7. If they’re still getting breached then they obviously aren’t serious about security.
That’s … TFW words aren’t enough and too much, at once.
The issues are primarily with Azure, I believe.
I remember them saying all the same exact things in the early 2000s after a slew of widespread disasters. Security will never be a higher priority than whatever cool new thing they want to sell.
Look at this smug assholes face. He knows damn well they won’t be doing anything of the sort unless it increases their profit margins. And he also knows damn well the government won’t do anything to seriously hinder their margins.
Bread and circuses. This is just another show. You want change? Stop using Microsoft. Period.
That’s all week and good for the minority of jobs that didn’t cling to it like a codependent partner.
Too late. Linux is going from my hobby project to my primary OS by the time they stop providing Windows 10 updates, if not sooner.
Thats what I did when win 7 support was ending, been very happy and there’s no way I’m going back to Windows.
Rather than driving the industry forward with leadership and vision Microsoft is being driven by AI and Advertising fads that are self destructing facebook and google.
Its clear its too late for Microsoft to do anything but lose trust at this point. If the outlook hacks and US government didnt cause them to rethink these terrible anti-privacy ideas then a bit of AI backlash won’t either. As soon as people look away they’ll start stuffing the OS with snoopware again.
Things like this that make me wish we still had the pillory punishment.
Look at his smug little smile. He knows they are not going to do shit. The smile would fade quickly if he faced 6 hours locked up being pelted with rotting vegetables and fruit in 90° heat.
Didn’t they already do that a decade or two ago??
Lol, Microsoft will focus on profits and shareholders, and shareholders want AI cramed into everything.
The only way to get them to really make changes is to leave.
So they lied und tried to cover it up, which led to the largest cyber attack ever. There’s going to be serious punishment, right? Right?
(⁀ᗢ⁀) hahahaha
Oh, shit haha! I thought you were serious for a second. Can you imagine if we ever held a corporation accountable for the damage they’ve caused? I mean it obviously can’t happen, but wow! You had me for a second!
This time for sure !
Microsoft uses damage control.
fancy animation
It was not effective.
Microsoft is confused.
It hurt itself in it’s confusion.
Linux is great. It was initially concerning to migrate but overall I’m happy I did. I assume Microsoft will attempt to make things more incompatible and proprietary as a last chance attempt to hold onto users. Ultimate this will just lead to more people switching to Linux faster over time.
There is no way a regular user will switch to Linux. And that is comming from me, who is an advocate for Linux desktop daily driver.
Some distros are really beginner friendly
As beginner friendly as they are you still can’t play Sims 1 and 2 on them.
You can’t play Helldivers 2 because of the anti cheat it has. Also some what less importantly it can run any of my work software. Now, I could dual boot but this a pain to deal with because now I have to swap OS’s depending on what software I want to run.
Wrong, entirely. I have played Helldivers 2 on Linux Mint using Proton Experimental compatibility through steam.
Helldivers works fine. Sometimes its anticheat complains but most of the time when that happens it launches and works anyway or you kill it and start again and it works.
I could not get it to load up. The game would load but the anti cheat just refused to run, and then I couldn’t connect.
I couldn’t get anything to work but steamdb seems to have plenty who do. I will try again.
This right here is my biggest complaint about Linux. Sometimes it just doesn’t work properly and the only person on the entire planet that has the issue is you, and therefore no one else believes or can help you.
Looking at steamdb. I see a ton if Tumbleweed. That might be worth looking into but I also see nobody running my GPU. Its a 2080 TI that is basically my old faithful. I promise its that. If I had an AMD, or even an Intel, I bet my games would run fine. I dont think I saw 1 review using my GPU on steamdb.
Never been an issue for me debian+kde+steam it started right up the first time i tried. No tweaking needed.
Those anticheats are so annoying. You can play brawlhalla on linux but since they added EAC you often can’t play offline because of random updates
I’d say the problem with Linux is not so much with beginner users, it’s easy enough to setup a basic desktop with a web browser and some tools, but with intermediate users who know enough to be dangerous on Windows and think that makes them “advanced”, who then can’t apply their clickety clackety ways of figuring things out on Linux.
Yes, they are. But there are still some issues and don’t get me started on MS Office which many people are used to. Belive me, that the true hill the Linux will die on. I tried to switch couple of people and they all refused because of the MS Office. And no, LibreOffice, nor OnlyOffice nor Google or MS online editors do not hit the mark sadly.
I really hate Office’s UI especially Word, but in all schools they teach it. sadly
I thought I would never switch to Linux, and here we are.
I doubt MS even knows what security means
Oh they know, Azure is running on Linux
Don’t take any of their words for granted. They know exactly what they’ve been doing, and what they’re doing now
Security over AI my ball-cheeks
I hope MS can fulfill its promise and not abandon it like they did with Surface RT, Windows Mobile, Windows Phone 7, Lumia, Kinect, Xbox, MSN Messenger, Cortana, Tango Studio, “Windows 10 is MS’s last OS”, etc.
Why in the absolute fuuuuuck would a “secure” computer with sensitive data be running motherfucking Windows?! Linux is easy enough for pretty much any Windows user in an office environment to handle these days. There’s just no excuse for sensitive business to ever be done on Windows at this point.
The company I work at “supports” Linux in the sense that you’re allowed to use Linux but then you’re essentially on your own when it comes to solving problems. I asked why there’s no proper Linux support and the short answer was “it’s too much trouble”. The long answer was “don’t ask. I don’t want to get into it”.
So my guess is that setting up company wide policies and support for Linux is significantly more work than it is for Windows or Mac.
This is like that psychopath GF that lies and pushes you around to test your limits with the evil plan to manipulate you. Every once in a while you can complain about her behavior and then she will bombard you with fake love and forgiveness to push later in the future again.
Question is: For how long? Security costs money, AI brings profits (in several ways).
At the moment they are making a big production of caring for the user. Which they basically never did, actually. They are only as pro user as they have to to improve their profits. Just wait until the shareholders reign them in because they want the company to extract more money out of the
customersvictims.That is basically the biggest fuck up you could make as a government contracted technology provider. They even let it happen and hid it deliberately.
Big paydays incoming for certain senators.
Until next week when they change their mind again
If Microsoft cares so much about security, then WTF are they doing greenlighting a project like CoPilot / Recall?
Businesses that buy the enterprise versions of their software can disable those features in policy.
They are far less concerned with your security than their paying customers: businesses.
Like most big tech companies, they’re actually several divisions all competing with each other. Lately, the AI divisions have latched on to the hype and they’re pushing their wares to other divisions, often with enough clout to keep those in security/privacy quiet. Integrating LLM’s is also a great way for a middle manager type to curry favour with the bosses, and to build little empires for themselves.
.
To be fair, MS “delayed” recall yesterday to fix the security issues, everybody else is hoping this is a soft-kill theverge.com/…/microsoft-windows-ai-recall-featur…
Its part of their large scale automation strategy, wherein they gobble up as much of the business practices of an organization’s staff as possible and then offer to provide “AI Employees” who replicate the logic of human staffers at a discounted price.
they don’t, this is all lip service
Are you kidding? I’ve known Microsoft as a shitty software vendor that gives a rats ass about security for over 40 years now. Microsoft never has cared about security, it’s a running gag at this point
three trillion dollars and they basically can’t do it
We prioritize security until our stock price drops a single point.
And this is exactly the problem. You STILL cannot trust them, fool me once, fool me twice?
This entire “weeewweeee sowwwyyy” bullshit excuse completely ignored the fact that they purposefully allowed the US government to be attacked because money is their bottom line. If it were a person (and aren’t companies persons now in the US?) they would have been jailed for treason. Jail these assholes already and switch ALL your computers to Linux
There needs to be a fine far larger than the contract to have any hope of curtailing this behavior.
The people making the decisions should be in jail. I don’t know if this is fraud in the legal sense but this is literally fraudulent behavior.
fucking seriously! Reading this absolutely disgusted me.
So we start…click on the paint brush icon…that tiny colourful thing right under the big ass “W” Icon. Now hit agree on the window asking if you’re secure. Wait a few moments and agree you your 2FA app on your phone. You might have to ask your wife to agree if you are married and bought the license for your spouse only. Cheapskate! Now stay here for a few minutes, we’ve called the 🚓🚨 police.
Seriously, why are governments using Microsoft software?
Don’t give me the nonsense line of “they need support”. There is support for Linux too, and Linux, sorry, works, is reliable and most importantly: a hell of a lot safer than windows. This is example #346269 where Microsoft not only fails to keep windows even remotely safe, but actively sabotaged their customers (in this case the US government) for their own profit.
And again, “wwheeeyyyrreee sooowwyyyy, pleeeaaasseeee forgif us?” Look! Look! Even our CEO will now be interested in secuwity!
Seriously I’m so tired of having to read this over and over and he government will just contoi to pump millions over millions into that piece of crap company.
Switch to Linux already and have computers that you can trust have no known issues that are not being resolved to cover for a few rich assholes!
A much much larger proportion of users are computer illiterate, especially federal employees. On top of that, the vast majority of basic software applications used are the Microsoft suite of Outlook, Word, Excel, PowerPoint, etc. How do you
The ENTIRE US govt runs on Microsoft. That’s a very big pie to rebake. Where do you even begin. I do agree with you, it just feels unsurmountable.
Political leadership isn’t technically knowledgeable. It is focused on building large social networks of agreeable people. And Linux is an application by and for techies, not CEOs or social clubs. Consequently, when you’ve got six old white Harvard Alums in a room discussing how to run the country, one of them is going to be a Microsoft C-level and none of them are going to mention an alternative OS (except maybe Apple, in so far as they want their phone to magically integrate with a hostile OS rival).
A lot of these Microsoft features are about internal surveillance of staff and accumulating behavior patterns for future automation of service. This is not intended to be about building trust in the OS from the perspective of system security. Its more about finding patterns in human behavior that can be leveraged to reduce the size and pay-scale of your work force.
To that end, Microsoft is a highly valued partner while the Linux developers are an outright threat.
When I worked with defense contractors in Canada, Microsoft would sue the government whenever it didn’t get awarded a contract it applied for.
A lot of the ‘big establishment’ companies will imediately sue when they lose a contract.
A few years back, the JEDI acquisition triggered Oracle and IBM:
I imagine it must suck to be involved in a big government procurement, because you are pretty much guaranteed to have to get pulled into legal proceedings by one or more of the losers.
Again, just install Linux.
Dump your windows, install Linux, be done with this nonsense.
Sadly, I cannot do this for my work computer.
You switching is like turning around a rowboat.
Them switching is like turning around a cruise ship.
You mean they have been letting it slip?
<img alt="" src="https://lemmy.world/pictrs/image/1b7e610c-afba-48b0-8ba2-c7625a7cd447.gif">
Oh yes, the thing they’re well known for succeeding at.
They excel at pivots
In today’s news, Microsoft commits treason against the United States Government.
!remindme 6 months
I wonder what the outcome will be.
This says everything about this shitty company. Worst of the worst. Because that’s how they make 90% of their cash. By exploiting licensing deals and siphoning data to sell to whomever because they do not care who it is so long as they bid the highest.
It’s amazing no one has tried to break up their control over PCs. Make this world make sense.
I’ve spent the better part of my life watching microsoft fuck people over and then when they finally - finally get called out on it they do a bunch of bashful aw-shucksing before doing it again and again and again.
No.
Microsoft is dead. Kill it with fire. The US government should have known better, but they didn’t because like every other organization they have a boatload of clueless mid-level managers who only every learned Windows and fall for microsoft’s garbage every time, despite the eye-popping price.
NO MICROSOFT. EVER. They’re a criminal organizaiton, the amount of destruction they’ve created will never be known.
no they won’t. these pricks literally fired their entire AI Ethics team… that tells you everything you need to know about where their priorities are.
the only thing they are gonna do about this is figure out a way to make people not angry, but continue to fo as much shady shit as they can.
Definitely wasn’t aware of that…
theverge.com/…/microsoft-ethics-society-team-resp…
It’s always one of the first things to get cut when companies try to save money.
Well I know companies are willing to terminate employees for the sake of keeping up profits or preventing the loss of a company, no doubt. But the fact that they terminated an entire department - AI Ethics. Which I have to only assume is not a good idea when you’re implementing a new technology that can definitely go out of control.
ai ethics teams are a joke. They deserve to get fired.
They legally can’t prioritize shit but shareholder profits. We are all about to watch a US based company, purposefully fuck over the US government and possibly us by extension, and nothing will happen. Fuck this oligarchy.
This is a lie… Stop spreading it as it helps corporations hide behind it to do evil shit
I just jumped down a rabbit hole, thank you. Where the fuck did that statement come from? I didn’t find the source of it. Only that its not true.
There was some case where shareholders sued the board or the CEO because they were borderline embezzling.
In the judgement there was some language that these thieves were not prioritizing the shareholders and from that, the whole lie evolved that USA corporations have to kill their grandma’s if that’s the only way to profit
too late