News for hackers. Stuff that matters.

A comment on U.S. and key allies accuse China of Microsoft Exchange cyberattacks. Parent comment

Re:U.S. and key allies accuse China of Microsoft Exchange cy... by aww_dang on Monday July 19, 2021 @07:40AM (#27881458)
The solution is the same in both cases. Don't use vulnerable software. The problem starts with the same actor in both cases, Microsoft.

I feel bad for the admins who are stuck with these systems.

[ Parent | on HN ]
Re:U.S. and key allies accuse China of Microsoft Exchange cy... by AnIdiotOnTheNet on Monday July 19, 2021 @08:03AM (#27881654)
> The solution is the same in both cases. Don't use vulnerable software.

So, basically, don't use software. Actually, given the horrific state of modern software, I can get behind that.

[ Parent | on HN ]
Re:U.S. and key allies accuse China of Microsoft Exchange cy... by aww_dang on Monday July 19, 2021 @08:10AM (#27881713)
You digress, but you're onto something here. I suspect I'm not the only one who cringes at bloated packages and sometimes rolls my own alternative.
[ Parent | on HN ]
Re:U.S. and key allies accuse China of Microsoft Exchange cy... by therealEleix on Monday July 19, 2021 @09:42AM (#27882553)
This is sadly true. We need to return back to the Unix Philosophy of do one thing and do it well. None of these multi-purpose tools that have terrible feature creep and try to take over everything cough systemd cough. In all seriousness though, a lot of software that should be simple and easy to audit ends up having all these dependencies that are ether no longer maintained or doesn't get the necessary code reviews and it isn't until stuff like this happens that it actually comes to light.

I'm all for re-using code when rebuilding the wheel would be a hassle but it has to be balanced with proper code review before it should be included. Developers are much too quick to include outside code with the assumption that other people have already done the necessary reviews and this is where a lot of devs are getting bit.

[ Parent | on HN ]
Re:U.S. and key allies accuse China of Microsoft Exchange cy... by maximus-decimus on Monday July 19, 2021 @11:11AM (#27883497)
They're not digressing. There is no such thing as not vulnerable software. Especially if the attacker is the government of one of the most powerful nations on Earth.
[ Parent | on HN ]
Re:U.S. and key allies accuse China of Microsoft Exchange cy... by ChemSpider on Monday July 19, 2021 @07:45AM (#27881498)
So you think that a Linux mail server is unhackable for a state actor?
[ Parent | on HN ]
Re:U.S. and key allies accuse China of Microsoft Exchange cy... by aww_dang on Monday July 19, 2021 @10:34AM (#27883062)
Nothing is perfect. I'm sure nobody here is proposing that. However the lack of perfect alternatives doesn't excuse Microsoft's or specifically MS Exchange's reputation.

https://en.wikipedia.org/wiki/Nirvana_fallacy

https://www.cvedetails.com/product/194/Microsoft-Exchange-Se...

[ Parent | on HN ]
Re:U.S. and key allies accuse China of Microsoft Exchange cy... by apercu on Monday July 19, 2021 @09:14AM (#27882286)
Lol. Love it. Don't use Microsoft, instead become an expert in cisco OS and Linux and don't spend ay time generating anything of economic value but instead spend all your time securing your infrastructure and doing pen tests.

(yes, if you are expert open source is easier top secure maybe, at least that was my experience 20+ years ago. Now I mostly pay companies like microsoft to host my stuff so I can do billable shit).

[ Parent | on HN ]
Re:U.S. and key allies accuse China of Microsoft Exchange cy... by ahiknsr on Monday July 19, 2021 @08:02AM (#27881642)
> Don't use vulnerable software

Is there any widely used software that doesn't have any vulnerabilities?

[ Parent | on HN ]