top | item 36770235

Microsoft lost its keys, and the government got hacked

317 points| tim_sw | 2 years ago |techcrunch.com | reply

142 comments

order
[+] Zelphyr|2 years ago|reply
I hate to go negative. I really do because, usually it doesn't improve the discourse whatsoever.

However, I feel like it needs to be said: Microsoft makes bad products[1]! They're overpriced, insecure, slow (it's astounding to me how slow their web properties are), and hard to use. Easily some of the worst UI I've ever seen and, what's worse, they've been like that my entire career. They keep slapping lipstick on the same pigs and claiming to have reinvented themselves.

Their support is so ungodly bad that it literally took one of their reps over a day to figure out what timezone I'm in. Meanwhile, two of my employees' emails were being randomly CC'd to the CEO for no apparent reason. The cause? Nobody knows. It just stopped happening. Even Microsoft couldn't tell me why it happened.

With a $2.5 trillion market cap, it may seem like they're killing it but, I really think they're riding on momentum just like IBM did. Twenty years ago, IBM's market cap was double what is is now and, in my experience, their products are every bit as bad (admittedly, I have almost no exposure to their big iron products).

So, what are our alternatives? I know many people who don't like Apple for various reasons. Linux on the desktop has been promised for 20 years. It's closer than it has ever been to being a solid replacement but I don't know that it's quite there yet.

It saddens me to say, I don't know what the answer is. I just know that we need to get away from Microsoft products and fast.

1: In my experience, the only two exceptions are VS Code and SQL Server.

[+] MrDresden|2 years ago|reply
After spending 5 years of corporate work having to wrestle with Azure (in a ci/cd capacity) I would never recommend Microsoft's cloud offerings to anyone.

Problem is that there is no other provider I would rather recommend. They are all bad in one way or another.

[+] giancarlostoro|2 years ago|reply
> It saddens me to say, I don't know what the answer is.

I think the answer is a company willing to put in the work to force GPU manufacturers to provide high quality hardware drivers for a commercial Linux Distro. I mean all out partnership with the various vendors. Then sell prebuilts, maybe someone like System76 has come close, or has the capacity to do so. The Linux issues for me always seem to be hardware specific. Then its just making sure whatever the default DE is, has enough necessary polish.

[+] formerly_proven|2 years ago|reply
> However, I feel like it needs to be said: Microsoft makes bad products[1]! They're overpriced, insecure, slow (it's astounding to me how slow their web properties are), and hard to use. Easily some of the worst UI I've ever seen and, what's worse, they've been like that my entire career. They keep slapping lipstick on the same pigs and claiming to have reinvented themselves.

Some think tank should make an analysis how many billions of dollars are lost in productivity across the globe if you compare the current MS Office stuff to an alternate of "the Windows 2000-era stuff, but with security patches" or "the FOSS office stack, with more money behind it".

Anyone wanna estimate how many digits that number has?

(Teams, while being ungodly slow, at least has the value proposition of being an integrated product - persistent chat, file sharing and voice / video calls - that really didn't exist in 2000)

[+] mozman|2 years ago|reply
I have always believed that MS products are designed in a way to maximize the value of commercial support, certificates, etc.

It's walled garden for lack of a better time and solving problems easily and quickly dilutes the value of MSCE and the army of paid consultants that exist.

It is a completely different universe from Linux

[+] yoyohello13|2 years ago|reply
It's even more hilarious because Microsoft are always loudly exclaiming telemetry is necessary for software improvement but based on how buggy and terrible most of their software is telemetry doesn't seem to be helping.
[+] petemir|2 years ago|reply
One anecdote I have about Microsoft is that I once set up in Hotmail my birthday 5 months in advance to what it was, probably to bypass some 18yo check. Eventually (5 months later, probably) I set it back to normal.

Since then, for a couple of years, my father got a notification saying that it was my birthday (and he even obliged to congratulate me, once; he was -- and luckily is -- old :) ). That setting was not available anymore anywhere, and my birthday was set to the correct date, but the problem still happened. I contacted Microsoft, but it was like they had no idea what I was talking about nor what could be the problem.

So yeah, I don't trust them nor like them either.

[+] orangepurple|2 years ago|reply
Linux on the desktop is here. Go all-in on KDE. Everything is seamless and just works.
[+] mschuster91|2 years ago|reply
> With a $2.5 trillion market cap, it may seem like they're killing it but, I really think they're riding on momentum just like IBM did. Twenty years ago, IBM's market cap was double what is is now and, in my experience, their products are every bit as bad (admittedly, I have almost no exposure to their big iron products).

People are only not shitting on IBM so much anymore because they sold off Lotus Notes...

[+] navigate8310|2 years ago|reply
> So, what are our alternatives? I know many people who don't like Apple for various reasons. Linux on the desktop has been promised for 20 years. It's closer than it has ever been to being a solid replacement but I don't know that it's quite there yet.

When most people hear the word "Microsoft," their initial thoughts typically revolve around Windows and, at most, Office. However, it is important to note that a significant portion of Microsoft's profits actually comes from their Dynamics 365 offerings.

[+] dgoodell|2 years ago|reply
I work for NASA. Our budget is like $25B. We’re definitely inefficient and wasteful, but we still do a lot of new things. Just not nearly as much as we could.

Microsoft’s operating budget was like $123B last year. There are bugs in office products that have been there for years

What exactly are they doing with all that money?

[+] mistrial9|2 years ago|reply
you the user are not the customer, management and legal are the customer. You the user, are last, and least, in the priorities.
[+] reportgunner|2 years ago|reply
> What exactly are they doing with all that money?

Paying for ads and for developers that make ads I suppose.

[+] jdm2212|2 years ago|reply

[deleted]

[+] jtbayly|2 years ago|reply
This headline does a good job of pointing out why we shouldn't allow backdoors in encryption.
[+] exabrial|2 years ago|reply
Any Windows product/system is a liability. I'm not sure how to put this lightly. It was designed to create a monopoly first before any other goal.

And it's not that the alternatives are perfect, but Windows is as secure as swiss cheese.

[+] TheRealDunkirk|2 years ago|reply
I know this is a bit of a thread jack, but this same attitude now playing out on Xbox in the console space. The recent FTC attempt to block the Activision merger surfaced emails saying that they were just going to outspend Sony to further consolidate and buy a higher position in the market, because they can.

There's nothing in any of Microsoft's revealed communications over the years where they ever seem to aspire to make better products. I mean, sure, obviously, there are pockets inside the company, but that has never seemed to be the purview of the board or the executives. If there's a thought leader in there somewhere who had passion to make great products like Jobs, I can't think of who it would be.

I almost feel bad for Microsoft, and I say this as a Microsoft-hater and Linux zealot who ran it on the desktop for 19 years before switching to Mac. It's the legacy backward-compatibility that makes Windows so attractive to a lot of organizations which makes it so vulnerable. OTOH, corporate IT divisions love it because Microsoft lets them do all sorts of stupid things to it, like prevent me from changing the desktop background, so it's kind of a deserved punishment.

[+] lostmsu|2 years ago|reply
> Any Windows product/system is a liability.

A self-evident realization: every single product/system is a liability.

[+] nashashmi|2 years ago|reply
Heartbleed did not affect windows.
[+] JamesonNetworks|2 years ago|reply
Seems like they are assuming the same key was used to forge tokens and jump from that assumption to the conclusion that they found all instances of requests. If more keys were used to generate more tokens, isn’t it possible this attack had a much wider surface area?
[+] jamesjuicy55|2 years ago|reply
Absolutely. Maybe Louisiana and Oregon DMV hacks?
[+] victor106|2 years ago|reply
One of the reasons why we moved away from using Microsoft products for our identity management to Okta.

Not that they are bad products per se, but as many organizations use Microsoft products they are prime targets for too many hackers and it’s hard going to bed thinking that your identity info might be hacked someday and/or not knowing if it will be.

The surface area that Azure/Microsoft have is just too large for it to assume to be protected by one company whose security as not been the most stellar. So we are actively moving to GCP as well.

[+] likecarter|2 years ago|reply
Okta has been hacked a couple times now...
[+] AtNightWeCode|2 years ago|reply
We use MS for some stuff and did use Okta for others. But... Okta fkd up and can never be used in any enterprise today. We migrated from it. Everybody should. Now we use MS and Google. Okta is probably the most over-priced service in history of CS especially considering the poor sec design. They do however solve the US-Franchise-Corp bs that I guess it was designed for.
[+] fsociety|2 years ago|reply
Okta is also a prime target for hackers, and likely has a smaller security budget than Microsoft.
[+] 2OEH8eoCRo0|2 years ago|reply
> Microsoft still doesn’t know — or want to share — how China-backed hackers stole a key that allowed them to stealthily break into dozens of email inboxes, including those belonging to several federal government agencies.
[+] Incipient|2 years ago|reply
What's with all this fairly overt state sponsored hacking and everyone going "aww shucks" and moving on quietly?
[+] mikrotikker|2 years ago|reply
War with China already started in the cyber space. In fact its probably the pre war intelligence gathering and backdoor installations
[+] collsni|2 years ago|reply
Isn't cloud fun?

Same keys to everyone's kingdom!

[+] nubinetwork|2 years ago|reply
[+] dmvdoug|2 years ago|reply
And yet, fascinatingly, very very little discussion. 60-ish comments was the most on any of those posts.
[+] yladiz|2 years ago|reply
Just posting these links, some of which have no comments, is a bit much and not actually helpful. It would be better to do a little more curation and choose the most active ones.
[+] NVHacker|2 years ago|reply
"Use MS products and you will get hacked" is not exactly news, is it ?
[+] djbusby|2 years ago|reply
How did you even get all those so fast?
[+] michaelteter|2 years ago|reply
Perhaps preceding your list of related links you could state that the following is a list of (recent?) related HN submissions.
[+] neilv|2 years ago|reply
Did anyone start getting Microsoft "single use code" emails last night?

(Maybe if you have an Microsoft consumer account that you don't use, forgot you had, and might be incompletely set up.)

[+] zingababba|2 years ago|reply
Interesting that it aligned with their AAD rebrand.
[+] amai|2 years ago|reply
What do you expect? Microsoft is a gaming company. They don’t care about security.
[+] pjdemers|2 years ago|reply
This sounds like an inside job.
[+] iJohnDoe|2 years ago|reply
Speculation. This type of key issuance is given to FBI and NSA and other partnerships Microsoft has. China hacked their way up to get the keys.
[+] yttribium|2 years ago|reply
American companies are generally forbidden by EEOC rules from having reasonable security precautions unless some product is associated with a government contract and can require full blown security clearances. As a result you can safely assume that any given department with a juicy portfolio is fully compromised by foreign intelligence.