i was under the impression that they had made massive investments and really turned that around ... or is that ironically only windows? (or just a mistaken impression?)

They did make massive investments in the mid-2000s on Windows security, and really did turn a lot of things around.

But it is a big place. And not everyone gets the memo.

microsoft has always had a culture of "just make it work yesterday" that led to shoddy code. they spent a lot of money, some of it on PR and some of it on real work, polishing up some of windows's more egregious problems a couple decades ago. but the attitude is deeply ingrained in the leadership. i also suspect that a lot of cost-cutting demanded by the business side gets implemented by off-shoring work to the cheapest possible workers with the minimum experience necessary to push a product out the door, but im not as familiar with microsoft these days.

the same attitude is still there

the product only has to be just good enough to get some pointy haired boss to approve the purchase

(and he never has to use the software)

There was the famous "Bill Gates memo" early in the century that stopped work on pretty much everything except security, citing Windows' atrocious reputation as an existential risk to Microsoft. It lead to a big improvement, including UAC and driver signing.

Also it's worth differentiating between Azure and the rest of the Microsoft silos. The Xbox isn't being cracked on the regular. The microvirt for applications and browsers in desktop Windows seems very well thought out. It seems as though the Azure team are pretty awful, though.

I see tons of jobs notifications from Microsoft..all for Azure.

"Villanized" ? It's not villanizification if it's truty..

The villanizificationery of Microsoft is out of control.

i agree, the villainizificationeryzationalism is beyond the pale. truty epical in proportionation.

Windows 11 has also been plagued by bugs in the Microsoft Defender UI until recently, and it has been warning users about security risks even when they block Microsoft telemetry. This shows that Microsoft is not taking security seriously.

Yes, and rightly so.

It's hard to even describe how historically bad they've been; they normalized and encouraged unsigned binaries, essentially viruses and worms, and were NEVER punished.

What should the punishment for Arch, Debian and Fedora be, then? Not only are unsigned binaries normal there, but as far as I know, the infrastructure doesn't even exist to check the signature of a binary on execution.

I mean Debian and Fedora (not an arch user) sign their packages with GPG. It's a higher level up but effectively the same thing.

A runtime signature check is far more secure than an install-time signature check. On Linux you can swap a binary with an evil version using one of a million local privilege escalations available and nobody would ever know unless you have additional tripwire-style tooling set up.

The repositories support signing so binaries that are sourced from these repositories are verified by the associated signatures during installation. If you trust the installation, would you include the execution in that same trust? Windows does not include signed repositories (or any that I know of) by default. (I could be wrong about that but if it does exist, the software collection is nowhere as vast as the distro repositories.)

1. Debian - SecureApt - https://wiki.debian.org/SecureApt

2. Arch - pacman/Package signing - https://wiki.archlinux.org/title/Pacman/Package_signing

3. Fedora - RPM - Checking Package Signatures - https://docs.fedoraproject.org/en-US/fedora/latest/system-ad...

Windows does not generally have the concept of a 'repository' (WinGet excluded, but that's fairly new). The Microsoft Store is the closest thing to a repo, and those are signed.

Everything coming from Windows Update is also signed by a public CA.

None, but the reasons are more legal than technical.

None of those projects have come close to Microsoft in terms of creating a product, for pay, that average people reasonably rely on.

Again, using a legal definition of reasonably; a widely used and paid for product can be held to something like a "merchantability" standard - especially if Microsoft has ever claimed their product to be safe and secure, which I'm fairly certain they have.

My completely unqualified outsider perspective is that they're a slightly different phenomenon. The old school Microsoft security issues stemmed from security being more or less an afterthought or with comically bad default options. Many years and many billions of dollars later those systems are largely OK. But of course onprem systems are often not patched - but that's arguably not their fault (although Microsoft have made patching much harder than it needs to be, possibly to drive SCCM sales I'm not sure).

Azure...is a whole other thing. Every single service I look at feels like it's been developed two or three times, and renamed at least once...with varying degrees of backwards compatibility/interoperability/deprecation. The security interactions must be a nightmare to properly test for MS. On top of this it feels like there's multiple strategies being enacted simultaneously which makes it hard as an admin user to know you're doing the right thing in general.

Other cloud providers undoubtedly have some of the same issues with complexity/change but AzureAD (now renamed to Entra ID for whatever reason) is being used to manage core things like user accounts and mailboxes for organisations of all shapes and sizes (often without internal security teams).

There's also an unpleasant feeling that security is an upsell opportunity. It's a bad look.

The AWS model of each service being operated by a near independent company actually seems much easier to test and secure. Similar to modular code.