News for hackers. Stuff that matters.
[dead]
Re:Windows Defender is enough, if you harden it by inglor on Sunday March 06, 2022 @03:30PM (#30580967)
The inability to simply "see client data" even if you go through multiple bastions did kind of surprise me. I worked at several startups before Microsoft where just asking the client for permission was considered OK.

This certainly makes debugging production issues much much much harder - there are certain environments whose data you simply can't access (either as a user or as an administrator) and you have to rely on telemetry (much of which you can't gather since it can possibly be used for PII - this is all an audited process) to debug issues (attaching a debugger is also prohibited since you can read data that way and the port is closed).

Instead of trusting me - think of the corporate incentive to do well here. Consider how much it would cost a company like Microsoft if employees were exposed to confidential customer data (our customers can work with medical data, so a fairly expensive legal nightmare) vs. what the company gains (engineers have a slightly easier time debugging). At Microsoft scale I guess it simply makes sense to be super strict about this.

Re:Windows Defender is enough, if you harden it by ChuckNorris89 on Sunday March 06, 2022 @03:37PM (#30581022)
>Instead of trusting me - think of the corporate incentive to do well here.

Unfortunately, when it comes to anything Microsoft related, due diligence research and logical thinking is rarely employed by the HN crowd, and instead replaced with anger and FUD. I've lost count of the amount of comments saying Microsoft is forcing TPM to spy on us.

Not saying that the alphabet agencies or nation states couldn't misuse Microsoft's reach to get more private customer data, but that would apply to all US based corporations, not just Microsoft. And since AFAIK, Microsoft seems to never have been hacked for its customers' data to be leaked like it happened to Sony and Facebook, it seems they're doing a good job so far of keeping the amateur bad actors out and their customers safe.

So thanks for commenting and sharing inside infos, as some big companies ban their employees from doing the same.

Re:Windows Defender is enough, if you harden it by nix23 on Sunday March 06, 2022 @03:46PM (#30581103)
>but that would apply to all US based corporations

Thanks, no one said otherwise....but then it's no a quality standard per se ;)

Re:Windows Defender is enough, if you harden it by BiteCode_dev on Sunday March 06, 2022 @03:40PM (#30581055)
> Instead of trusting me - think of the corporate incentive to do well here. Consider how much it would cost a company like Microsoft if employees were exposed to confidential customer data (our customers can work with medical data, so a fairly expensive legal nightmare)

The last 3 decades of big players misbehaving taught us they usually get a slap on the wrist for pretty much everything at worst, and a fine of half the money they made from the feature at best.

I'm not sold.

Re:Windows Defender is enough, if you harden it by nix23 on Sunday March 06, 2022 @03:44PM (#30581086)
So true, maybe i am an old grumpy guy, but at least i learned something from the past.

Not sold too ;)

Re:Windows Defender is enough, if you harden it by KennyBlanken on Sunday March 06, 2022 @09:40PM (#30583629)
> Instead of trusting me - think of the corporate incentive to do well here. Consider how much it would cost a company like Microsoft if employees were exposed to confidential customer data (our customers can work with medical data, so a fairly expensive legal nightmare) vs. what the company gains (engineers have a slightly easier time debugging). At Microsoft scale I guess it simply makes sense to be super strict about this.

Your employer has been caught twice providing NSA backdoors in its operating system and its "home" edition makes it impossible to disable a stunning and completely unnecessary level of telemetry data.

Re:Windows Defender is enough, if you harden it by rblatz on Sunday March 06, 2022 @11:53PM (#30584348)
Third time this thread you’ve made this disproven claim. Give it a rest.
Re:Windows Defender is enough, if you harden it by nix23 on Sunday March 06, 2022 @03:42PM (#30581068)
Look, it really was not a personal attack on Microsoft engineers, but the plain and simple reality that Microsoft is a US Corporation and Azure falls under the "Cloud-Act" says everything, the fact that engineers don't have access to customer data is probably just to prevent leaks. And i bet Microsoft makes more than 99.9% compared to others to protect customer data...but then, no one can proof it.