If someone robbed your apartment would it be convenient to accuse you of low-security procedures instead of condemning the bad actors

A better analogy would be, if you were a company selling doors - after a string of break-ins involving some group casually walking through your products like they weren't there, somebody would eventually start asking about your responsibility.

(Maybe "cyber insurance" needs to be a thing in the SMB world? As much as I feel it's currently mostly nonsense, maybe it's serviceable. In the physical world, it seems the driving force behind buying security measures is not the (unlikely) possibility of being a victim of a break-in, but the (more likely) possibility of not getting insurance to cover it.)

>A better analogy would be, if you were a company selling doors - after a string of break-ins involving some group casually walking through your products like they weren't there, somebody would eventually start asking about your responsibility.

Actually most locks are susceptible to being picked (ie. a known exploit), so what you're describing is already the case, minus the lawsuits.

Locks being susceptible to lock picking actually turns into a feature when, for example, you're locked out or lose your keys: you just call a locksmith and they pick it for you.

There's no perfect security in the real world.

Windows instead of doors would have worked just as well.

Cyber Insurance is a huge growing sector in Toronto at least, and I worked on strategy for a "startup" in the space last summer.

You can't sell doors unless there's clear low enforcement that prohibited criminal activities. You need an environment to operate.

> Portcullises fortified the entrances to many medieval castles, securely closing off the castle during time of attack or siege.

Is the US in a state of war with China? Do we need medieval tactics to deal with cyber security? Why insisting on blaming the victim.

I get your metaphor but I don't think it meets the situation. If you were paying a security guard to watch your apartment and they instead went to guard some other place for additional money for 2 hours and then your apartment got robbed, well, that security guard is Microsoft in this example.

If you brought a security door, and the thieves just had to knock on it on the right frequency to open, yes, you would accuse the door seller of fraud.

Locks get picked literally all the time, and nobody sues lock makers. Perfect security does not exist.

Security can never be perfect. However negligence, bloat and poor design decisions are still a thing. The ideas are not mutually exclusive.

And you can confidently claim that Microsoft was negligent here? You have in depth knowledge of their architecture decisions?

How confident are you that you could write an email server that could withstand extended attacks from nation states?

So if I personally haven't written an email server, then I shouldn't criticize MS Exchange?

How would that work for something like a Boeing 737 max?

Yes, I am confident I could process text over the network without (42) remote code execution vulns.

https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...

>Microsoft revealed that these vulnerabilities had existed for around 10 years

https://en.wikipedia.org/wiki/Microsoft_Exchange_Server#Vuln...

If the property management company demanded that I use Insecure Brand locks on my front door, I'd have an issue with that. Of course that wouldn't excuse the robbers, but continuing to use Insecure Brand locks wouldn't be advisable. I'd also take exception if IB Locks or the property management company marketed themselves as a security oriented company.

> continuing to use Insecure Brand locks wouldn't be advisable.

Agreed. Microsoft should clarify how this happened and what measurements will take to prevent this incident from happening again. Still, the problem is with robbery and it should be condemned. Why changing the subject to Microsoft? I don't think whataboutism is the valid argument here.

It is not whataboutism. It is about 3 decades of seemingly intentional inability to deliver secure product on the mildly evil calculation that the subscriber will need 'security updates' and 'support'.

There is a good argument to be made that Windows is a big target, but they should at least try not making it so easy.

> It is about 3 decades of seemingly intentional inability to deliver secure product.

This is a consumer choice. You don't trust Microsoft, you don't use its services. On the government level, you ask for regulations if the situation is escalated (if necessary). But dealing with global cyberattacks is not Microsoft problem and it's not connected to one company or one service. It's an international responsibility to act and establish a framework that prevents such attacks.

Just the other day I was listening to a radio show ( further right than shown in mainstream ), where a user was clamoring for a proper locked down version of Windows where nothing can go wrong.

The current situation ( and the resulting clamoring ) is absolutely a direct result of people who create this software. Trying to shift the blame onto nonexistent framework is at best laughable and at worst very deceptive. It absolves MS and its engineers from guilt associated with it.

To put it another way, if those engineers were bridge engineers, we would now be witnessing multiple collapses with swathes of engineers arguing that it is not their fault as 'there is an international responsibility to act and establish a framework' that prevents bridges from falling apart.

I am sorry. I do not buy this defense. As an architect, you should know better.

I don't know if you gonna read this, but I should give a credit for your take on the subject. This is what you were talking about: https://edwardsnowden.substack.com/p/ns-oh-god-how-is-this-l...

You have a valid point. I am not arguing against it. I was trying to say discussing how MS deals with the subject is not the point. But after reading your recent comment, well, I guess we should talk more about MS failure.

Look, you could be right in... usual case.

But we speaking freaking NATO here !!!!! Do you attach string to hand granade and hand other side to your adversary ? And then argue that someone pulled it ??

Microsoft Windows and Microsoft Exchange is SYNONYM to "security HOLE" ! So tell me - why customer NATO _choose_ to use this ?

I don't think NATO has any value here. It's a signal of unity not just to China but to Russia. This is how Biden admin defines "America is back". So it might be aggressive but actually, it's a unity message. Us, the allies, against them the adversaries.

The issue is not that a random guy on the internet hacks the software, but a _state_ actor.

Eh, the issue was found by a random (Chinese) guy on the internet. And it was reported to Microsoft in the beginning of January. It got leaked and once you have the exploit chain - yeah, pretty much any random guy on the internet could use it for hacking. A few days after MS disclosure there were in fact independently produced exploits by other random guys.

The solution is the same in both cases. Don't use vulnerable software. The problem starts with the same actor in both cases, Microsoft.

I feel bad for the admins who are stuck with these systems.

> The solution is the same in both cases. Don't use vulnerable software.

So, basically, don't use software. Actually, given the horrific state of modern software, I can get behind that.

You digress, but you're onto something here. I suspect I'm not the only one who cringes at bloated packages and sometimes rolls my own alternative.

This is sadly true. We need to return back to the Unix Philosophy of do one thing and do it well. None of these multi-purpose tools that have terrible feature creep and try to take over everything cough systemd cough. In all seriousness though, a lot of software that should be simple and easy to audit ends up having all these dependencies that are ether no longer maintained or doesn't get the necessary code reviews and it isn't until stuff like this happens that it actually comes to light.

I'm all for re-using code when rebuilding the wheel would be a hassle but it has to be balanced with proper code review before it should be included. Developers are much too quick to include outside code with the assumption that other people have already done the necessary reviews and this is where a lot of devs are getting bit.

They're not digressing. There is no such thing as not vulnerable software. Especially if the attacker is the government of one of the most powerful nations on Earth.

So you think that a Linux mail server is unhackable for a state actor?

Nothing is perfect. I'm sure nobody here is proposing that. However the lack of perfect alternatives doesn't excuse Microsoft's or specifically MS Exchange's reputation.

https://en.wikipedia.org/wiki/Nirvana_fallacy

https://www.cvedetails.com/product/194/Microsoft-Exchange-Se...

Lol. Love it. Don't use Microsoft, instead become an expert in cisco OS and Linux and don't spend ay time generating anything of economic value but instead spend all your time securing your infrastructure and doing pen tests.

(yes, if you are expert open source is easier top secure maybe, at least that was my experience 20+ years ago. Now I mostly pay companies like microsoft to host my stuff so I can do billable shit).

> Don't use vulnerable software

Is there any widely used software that doesn't have any vulnerabilities?

Microsoft will be accused of inserting backdoors that are accessible to non US-affiliated actors /s