Re:"Secret" Agent Exposes Azure Customers to Unauthorized Co...
by paxys on Tuesday September 14, 2021 @09:35PM
(#28534099)
Exactly. It's not like Microsoft picked up a random unaudited open source project and shoved it into all Azure VMs. OMI is maintained by Microsoft and the fact that it is open source is a good thing security wise. I'd wager being able to look at the source code greatly helped the researchers in their diagnosis as well.
[ Parent
| on HN ]
Re:"Secret" Agent Exposes Azure Customers to Unauthorized Co...
by craigkerstiens on Tuesday September 14, 2021 @09:37PM
(#28534123)
At some level, agreed that it probably helped security wise for researchers. That the fix was committed in public and then vulnerability remained for a month and well still currently for customers is where one could make a case that the open source nature did as much damage as good.
Re:"Secret" Agent Exposes Azure Customers to Unauthorized Co...
by hannob on Wednesday September 15, 2021 @06:34AM
(#28537441)
> That the fix was committed in public and then vulnerability remained for a month
That's an indication that Microsoft is bad at handling security issues. Which isn't news and has very little to do with open source. Something very similar happened with Exchange, it led to plenty of people being compromised, and Exchange is not open source.
Re:"Secret" Agent Exposes Azure Customers to Unauthorized Co...
by formerly_proven on Wednesday September 15, 2021 @03:37AM
(#28536335)
When you distribute patches for a vulnerability it basically makes no difference whether the source for those patches is available - people are quickly going to figure out what the vuln is. This is a patch rollout problem and nothing else.