>Why? Why does company size have anything at all to do with the security of their product?

Because they have the money to hire people who know what they're doing, though it seems they are having difficulty selecting the right candidates.

Google has the money to hire customer service representatives for customers to call when they have a problem, but they don't do so, because it's not a priority for them. It's the same with Microsoft and security.

Yes, and Google rightly gets criticized for it. Microsoft is getting the same treatment for being equally shitty.

Right, and how is this helping?

Yes, Google gets criticized for not having any customer service. So... what? Has this affected Google's profitability one iota? No.

Same with MS.

I don't understand your objective in this conversation. Are you trying to argue it's okay that Microsoft is incompetent, because Google also has bad customer service? Or that we shouldn't criticize Microsoft's awful security practices because it's "not their priority"?

Size is correlated with resources. Microsoft should have the resources to throw at this problem.

Unfortunately the Microsoft approach to software engineering is to set a bunch of monkeys loose on a room full of keyboards, rather than to spend their considerable resources vying for top talent.

(Obviously they do have some good engineers, no offense if you're one of them, it's simply that from my sample size of 5, 80% were just warm bodies with email access.)

Of course they have the resources. What they don't have is the incentives to do better. Just like every other big company that has a breach, they are not punished when they ignore basic security and they are not rewarded for paying attention to it. In fact they are punished by Wall Street for paying attention to it, because that costs money.

As long as all they have to do is say "Whoops! We're sorry" when a breach happens, we should expect breaches to be the norm for all big companies.

Hopefully a news item as large as this one will cause them to lose some contracts, at least at the margin.

You expect too much from Sales and CIOs/CEOs. Most of them have no idea what this is, but they make the decision to buy SW products.

> Of course they have the resources. What they don't have is the incentives to do better.

Off-topic: this is exactly the same reason that Google offers up ads for scams and ads containing or linking to malware on their own advertising network.

The only way to get to the size of these companies is to scale what can be scaled, and damn the rest until the pigeons come home to roost. Which, if they play their political-donation cards right, won't happen. And if it does, jeez they've made bank in the meantime, and will Goodhart the shit out of whatever watered-down legislational changes may make their way through.

They definitely have the incentives. This conversation is a good example of that. Azure is attempting to compete in an aggressively competitive market and their customers absolutely care about security.

Yep they could be hiring independent hackers to test their security 24/7 and they just simpley "don't" . It's like me doing a security audit of my own software, that would be just dumb, so you have pen test dudes who poke at it.

In addition to that, security should probably be a consideration at the design phase of any feature or product. As in, an internal team should be vetting design and critical areas of the code itself. But the culture there only cares about "partner requirements". Security, tech debt, UX are simply glossed over.

> Why? Why does company size have anything at all to do with the security of their product?

Because they have a massive security team. Size has a lot to do with security.

> What's truly insane is that people keep expecting Microsoft to do better, and then being disappointed when they don't.

Microsoft has done a ton of impressive security work when it comes to Windows, they've really stepped up their game. They've invested quite heavily.

More cooks ensures you get the same terrible burger in triplicate.

No. Security teams need staff.

> "the definition of insanity is doing the same thing and expecting a different result"

This is a nitpick, but it's often completely reasonable to expect a different result by doing the same thing. Nothing against what you wrote, I just hate this saying so much. It's usually wrong to assume things are context-free. Most of life is defined by routine. Erosion carved out the surface of the earth, breathing and eating keeps you alive, etc.

At some point the definition of "same" comes under scrutiny and you will find that it's impossible to truly do the exact same thing more than once, and yet even if it was possible you might still get a different result because other things you had no control over changed. Entropy makes it all just so.

Well, I think the saying kinda implies that the conditions are the same. Obviously, common sense dictates that doing the same thing when conditions are radically different can yield different results. (For instance, taking a deep breath is usually good for you. But doing so underwater is obviously not.)

Of course, this then leads to an argument over how the conditions differ in the example where the saying is used, like with MS here.

Well, practically speaking the conditions are never the same in the course of action. If you are trying to break something, for example, at first you don't succeed but in the end, after repeating the same action again and again, you finally do.