News for hackers. Stuff that matters.
Re:Windows 0day privilege escalation still not fixed by FartyMcFarter on Wednesday December 23, 2020 @03:19PM (#25521706)
This may explain it:

https://www.wsj.com/articles/microsoft-diminishes-windows-ro...

> The company is breaking Windows in pieces. The platform technology, on which Microsoft’s partners build their own devices, apps and services, will now fall under Scott Guthrie, who runs the Azure business. Mr. Guthrie’s unit, called Cloud + AI Platform, will also include the company’s mixed-reality business, including Microsoft’s Hololens device, as well as its artificial-intelligence business.

Maybe someone with insider knowledge will comment, but it looks like Windows is far from being a priority for Microsoft.

Re:Windows 0day privilege escalation still not fixed by dmix on Wednesday December 23, 2020 @03:48PM (#25522046)
Man I still can’t believe Azure is number 2 behind Amazon for cloud computing. When they first started their marketing push to developers years ago, which I remember was very aggressive and full of evangelism marketing which I disliked, I kind of blew them off as some mid tier or old school oddity.

But it really shows you how powerful their enterprise sales machine is and the legacy reach of existing programming languages/frameworks.

It’s always easy to underestimate Microsoft I guess. Ditto with Oracle and the like. From our view down in the startup world.

That said. Alt-tab not working is an embarrassment though. And I hope they really haven’t let their OS QA slip this badly in favour of some growth area or whatever.

Re:Windows 0day privilege escalation still not fixed by ManBlanket on Wednesday December 23, 2020 @06:15PM (#25523397)
The comparison of cloud platforms truly is heavily distorted at a startup. Most companies aren't comparing AWS and MS in a vacuum when presented with the decision. How much of the world's software runs on dotnet? Windows, Office, and Active Directory command their own predominant shares, not to mention other tools like CRM. MS earned a reputation for the battleship; relatively stable, plays nicely with their other products, LTS, backward compatibility, etc. Suppose the CTO for an insurance claims company is presented with the decision of migrating a legacy platform which already runs on a fat stack of MS products. They don't even need a salesperson to convince them Azure is the obvious first choice, because to them it's just another cannon on the battleship.

In my experience the tribal evangelism for AWS is... intense... and they've somehow convinced people to proselytize unpaid on their behalf. Having worked with both I'll occasionally mention Azure if only to revel at the spicy takes. Honestly though, I worked at that claims company I mentioned. Likewise the startup I work at today threw their hats in with AWS. Both were respectively good decisions, both bad in their own right. As ever, try to do everything and something is going to give.

Re:Windows 0day privilege escalation still not fixed by toast0 on Wednesday December 23, 2020 @07:31PM (#25523947)
> MS earned a reputation for the battleship; relatively stable, plays nicely with their other products, LTS, backward compatibility, etc.

Microsoft earned thst reputation with a lot of development and organizational practices that they've since abandoned. It may take people a while to notice, but today's Microsoft is not prioritizing stable software interfaces and backwards compatability.

It took a lot of testing to ensure existing software and hardware continued to work with new operating systems, and they're not doing as much testing anymore.

Re:Windows 0day privilege escalation still not fixed by jiggawatts on Wednesday December 23, 2020 @08:12PM (#25524187)
Microsoft had some of the best documentation in the world. People really don't understand how valuable that is, and how important. Microsoft in 2020 certainly doesn't understand. They produce vast reams of auto-generated "documentation" where the only text is the function names with spaces added between the words.
Re:Windows 0day privilege escalation still not fixed by TeMPOraL on Thursday December 24, 2020 @05:22AM (#25526378)
Reminds me of PowerShell. There's extensive, detailed and super-useful documentation for pretty much all the commandlets available... but it's not installed by default. Get-Help ... will happily tell you that you need to download help if you want to see any details beyond command signature. Who in their right mind though this is a good idea? Such documentation should be shipped with the default install.

I have it on the top of my mind because it bit me twice in recent month. I had to do some PS work on some VMs that didn't have Internet access (beyond RDP). Sure, I can Alt+Tab to a browser on my machine, but at this point, why even have Get-Help? Contrast that with Emacs experience, where everything is documented, and documentation is easily accessible, off-line, and by default.

Re:Windows 0day privilege escalation still not fixed by TwoBit on Wednesday December 23, 2020 @10:50PM (#25524885)
> I'll occasionally mention Azure if only to revel at the spicy takes.

Well there are a lot of old school Microsoft haters. I used to know a bunch of Unix guys ~ten years ago whose unstated principle was that anything Microsoft did was unilaterally a bad idea (and everything Unix ever did was always the best possible way).

Re:Windows 0day privilege escalation still not fixed by plif on Wednesday December 23, 2020 @04:20PM (#25522342)
Microsoft is also mostly purely tech. Amazon and Google (Alphabet) are more pervasive and threatening to other industries.

For that reason, I'm not surprised. I've seen the decision come down to not wanting to give money to the other two many times. MS is in a great position there.

Re:Windows 0day privilege escalation still not fixed by 411111111111111 on Wednesday December 23, 2020 @04:11PM (#25522273)
They're including managed services like office 365 in that number though.

Might be fair because aws includes their services as well, but I'm pretty sure aws main income is from ec2, while azure is business tooling like active directory, office etc

Re:Windows 0day privilege escalation still not fixed by semi-extrinsic on Wednesday December 23, 2020 @05:34PM (#25523069)
And they seem to be pushing customers very hard on moving from on-prem to cloud for Office and email stuff. I don't know if they're subsidising the cloud services for now, or what.
Re:Windows 0day privilege escalation still not fixed by jiggawatts on Wednesday December 23, 2020 @08:20PM (#25524235)
It's really obvious that Azure has much lower adoption than AWS. For example, I evaluated their new Front Door combo accelerator / CDN product recently. One page listed their customers, and there were about a half dozen total. Out of curiosity, I scanned the top 1000 domains and found none using it. I got the impression that I was one of the few people even evaluating it, let alone using it in production.

Despite just kicking the tyres on the thing, I found about half a dozen bugs or missing critical features. That's just shocking to me.

For comparison, CloudFront -- the most direct competitor -- is far ahead in features and is used by far more customers. It also works out of the box.

All of the other Azure services other than plain virtual machines give me the same impression of being a first adopter and one of only a handful of customers.

Re:Windows 0day privilege escalation still not fixed by PretzelPirate on Thursday December 24, 2020 @08:57AM (#25527456)
Those customers are probably using it in some of their services. I’ve worked with a number of enterprise companies who are moving to the cloud and most of them have never considered something like front door to route their traffic.

I’ve brought Front Door into their architecture for the services I was working on, but even if they decide it’s a great thing for the entire company to use, it will take them over a year to get security to approve it, and then multiple years to get it rolled out to all of their products.

With Azure’s core customer base being major enterprises, it’s not surprising that you had a hard time finding evidence.

Re:Windows 0day privilege escalation still not fixed by Quarrelsome on Wednesday December 23, 2020 @05:51PM (#25523211)
They still have a big .NET following and they make it easier to use Azure via their toolsets. I feel like it was mildly obvious that they'd do okay.
Re:Windows 0day privilege escalation still not fixed by recursive on Wednesday December 23, 2020 @11:15PM (#25525010)
Alt-Tab isn't broken for everyone. It's working on all three of the windows machines I regularly use.
Re:Windows 0day privilege escalation still not fixed by dboreham on Thursday December 24, 2020 @12:33AM (#25525292)
Alt-tab is working for me. Meanwhile, the bug first seen in prerelease versions of the new shell on NT3.51 in 1995, where the taskbar won't hide, is still present in the latest Win10 insider preview.
Re:Windows 0day privilege escalation still not fixed by vntok on Friday December 25, 2020 @11:31AM (#25537337)
Sounds like a feature, not a bug!
Re:Windows 0day privilege escalation still not fixed by thekyle on Wednesday December 23, 2020 @04:00PM (#25522166)
I may be wrong but I don't believe Microsoft even has a dedicated Windows division any more.
Re:Windows 0day privilege escalation still not fixed by radicaldreamer on Wednesday December 23, 2020 @04:33PM (#25522475)
Well that and they got rid of their QA and test engineers so nothing is caught before it's sent out... you just can't rely on free beta testers for everything.
Re:Windows 0day privilege escalation still not fixed by jodrellblank on Wednesday December 23, 2020 @04:52PM (#25522663)
> You just can't rely on free beta testers for everything.

Linux distros seem to manage pretty well...?

Or is this "it's only bad if Microsoft do it"?

Re:Windows 0day privilege escalation still not fixed by _jal on Wednesday December 23, 2020 @05:30PM (#25523029)
We pay RH rather a lot of money for the excellent testing and integration they do. (And alt-tab works, if you want it to.)

Or if you're trying to limit this to individual use, I'll grant you equivalence once Microsoft stops charging their beta testers and offers them the source.

Re:Windows 0day privilege escalation still not fixed by fomine3 on Thursday December 24, 2020 @12:04AM (#25525198)
Fedora and CentOS Stream is RHEL's upstream so it can be said as "beta test" from RHEL's perspective. (gamma?)
Re:Windows 0day privilege escalation still not fixed by rbanffy on Thursday December 24, 2020 @06:38AM (#25526687)
They all do upstream integration tests because nobody sane likes being caught by surprise.

Even I do it and I work for a company orders of magnitude smaller

Re:Windows 0day privilege escalation still not fixed by ehvatum on Wednesday December 23, 2020 @05:08PM (#25522830)
That’s an interesting point. Which for-profit Linux distro is using you as an unpaid beta tester for their closed-source code?
Re:Windows 0day privilege escalation still not fixed by gralx on Wednesday December 23, 2020 @05:14PM (#25522886)
Fair point. But 90% of Linux submissions are corporate, last I checked. Corporations (usually) do a lot of internal testing before submitting, and then maintainers have to review submissions. This is long before the public ("beta testers") has to deal with any bugs.

And that's only the kernel. Distributions and their package maintainers have their own quality controls, as do cross-distribution upstream developers. Public bug trackers (beta testers) are a complement to these. The division of labour in quality control of Linux systems is fine, diverse, and of variable effectiveness before beta testers come into the picture.

Re:Windows 0day privilege escalation still not fixed by 9HZZRfNlpR on Wednesday December 23, 2020 @05:01PM (#25522765)
If I'm paying for it, which I do hell no. O also use Linux but I don't ost for it, and it's hobbyist / power user os and I can actually fix things there unlike windows.