A better analogy would be, if you were a company selling doors - after a string of break-ins involving some group casually walking through your products like they weren't there, somebody would eventually start asking about your responsibility.

(Maybe "cyber insurance" needs to be a thing in the SMB world? As much as I feel it's currently mostly nonsense, maybe it's serviceable. In the physical world, it seems the driving force behind buying security measures is not the (unlikely) possibility of being a victim of a break-in, but the (more likely) possibility of not getting insurance to cover it.)

>A better analogy would be, if you were a company selling doors - after a string of break-ins involving some group casually walking through your products like they weren't there, somebody would eventually start asking about your responsibility.

Actually most locks are susceptible to being picked (ie. a known exploit), so what you're describing is already the case, minus the lawsuits.

Locks being susceptible to lock picking actually turns into a feature when, for example, you're locked out or lose your keys: you just call a locksmith and they pick it for you.

There's no perfect security in the real world.

Windows instead of doors would have worked just as well.

Cyber Insurance is a huge growing sector in Toronto at least, and I worked on strategy for a "startup" in the space last summer.

You can't sell doors unless there's clear low enforcement that prohibited criminal activities. You need an environment to operate.

> Portcullises fortified the entrances to many medieval castles, securely closing off the castle during time of attack or siege.

Is the US in a state of war with China? Do we need medieval tactics to deal with cyber security? Why insisting on blaming the victim.

I get your metaphor but I don't think it meets the situation. If you were paying a security guard to watch your apartment and they instead went to guard some other place for additional money for 2 hours and then your apartment got robbed, well, that security guard is Microsoft in this example.

If you brought a security door, and the thieves just had to knock on it on the right frequency to open, yes, you would accuse the door seller of fraud.

Locks get picked literally all the time, and nobody sues lock makers. Perfect security does not exist.

Security can never be perfect. However negligence, bloat and poor design decisions are still a thing. The ideas are not mutually exclusive.

And you can confidently claim that Microsoft was negligent here? You have in depth knowledge of their architecture decisions?

How confident are you that you could write an email server that could withstand extended attacks from nation states?

So if I personally haven't written an email server, then I shouldn't criticize MS Exchange?

How would that work for something like a Boeing 737 max?

Yes, I am confident I could process text over the network without (42) remote code execution vulns.

https://www.cvedetails.com/vulnerability-list/vendor_id-26/p...

>Microsoft revealed that these vulnerabilities had existed for around 10 years

https://en.wikipedia.org/wiki/Microsoft_Exchange_Server#Vuln...

If the property management company demanded that I use Insecure Brand locks on my front door, I'd have an issue with that. Of course that wouldn't excuse the robbers, but continuing to use Insecure Brand locks wouldn't be advisable. I'd also take exception if IB Locks or the property management company marketed themselves as a security oriented company.

> continuing to use Insecure Brand locks wouldn't be advisable.

Agreed. Microsoft should clarify how this happened and what measurements will take to prevent this incident from happening again. Still, the problem is with robbery and it should be condemned. Why changing the subject to Microsoft? I don't think whataboutism is the valid argument here.

It is not whataboutism. It is about 3 decades of seemingly intentional inability to deliver secure product on the mildly evil calculation that the subscriber will need 'security updates' and 'support'.

There is a good argument to be made that Windows is a big target, but they should at least try not making it so easy.

> It is about 3 decades of seemingly intentional inability to deliver secure product.

This is a consumer choice. You don't trust Microsoft, you don't use its services. On the government level, you ask for regulations if the situation is escalated (if necessary). But dealing with global cyberattacks is not Microsoft problem and it's not connected to one company or one service. It's an international responsibility to act and establish a framework that prevents such attacks.

Just the other day I was listening to a radio show ( further right than shown in mainstream ), where a user was clamoring for a proper locked down version of Windows where nothing can go wrong.

The current situation ( and the resulting clamoring ) is absolutely a direct result of people who create this software. Trying to shift the blame onto nonexistent framework is at best laughable and at worst very deceptive. It absolves MS and its engineers from guilt associated with it.

To put it another way, if those engineers were bridge engineers, we would now be witnessing multiple collapses with swathes of engineers arguing that it is not their fault as 'there is an international responsibility to act and establish a framework' that prevents bridges from falling apart.

I am sorry. I do not buy this defense. As an architect, you should know better.

I don't know if you gonna read this, but I should give a credit for your take on the subject. This is what you were talking about: https://edwardsnowden.substack.com/p/ns-oh-god-how-is-this-l...

You have a valid point. I am not arguing against it. I was trying to say discussing how MS deals with the subject is not the point. But after reading your recent comment, well, I guess we should talk more about MS failure.

Look, you could be right in... usual case.

But we speaking freaking NATO here !!!!! Do you attach string to hand granade and hand other side to your adversary ? And then argue that someone pulled it ??

Microsoft Windows and Microsoft Exchange is SYNONYM to "security HOLE" ! So tell me - why customer NATO _choose_ to use this ?

I don't think NATO has any value here. It's a signal of unity not just to China but to Russia. This is how Biden admin defines "America is back". So it might be aggressive but actually, it's a unity message. Us, the allies, against them the adversaries.