News for hackers. Stuff that matters.

A comment on Microsoft Chose Profit over Security, Whistleblower Says.

Re:Microsoft Chose Profit over Security, Whistleblower Says by pgraf on Thursday June 13, 2024 @11:10AM (#40670664)
Imagine a major bridge that was built by a contractor. A internal safety inspector repeatedly warned his supervisors of structural deficiencies that could lead to the collapse of the bridge. Furthermore, in the pass of time two external sources publicly warned about the issue, but the company downplayed the importance. Finally, the bridge collapses. It becomes evident that the company did nothing about the issue because it didn‘t want to loose contracts selling more flawed bridges. The public would justifiably go nuts, and there would be legal consequences for everyone involved.

What is different in our industry that companies (and managers) get away with such malice?

[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by magicalhippo on Thursday June 13, 2024 @11:59AM (#40671265)
Here in Norway a bridge built with known structural deficiencies did in fact collapse[1], and basically nothing has happened except tax payers get to pay even more for a new bridge.

Unless enough lives are lost, people generally don't care that much it seems.

[1]: https://www.nrk.no/innlandet/statens-vegvesen-legg-fram-rapp...

[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by _heimdall on Thursday June 13, 2024 @12:07PM (#40671392)
I'm not sure if this would line up with the Dunbar number or something similar, but it sure seems reasonable that societies and centralized power should never grow beyond the scale where people stop caring.

If the public is expected to keep government and corporstions in check but the public doesn't care, it can only end poorly.

[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by nicce on Thursday June 13, 2024 @12:05PM (#40671370)
> basically nothing has happened

Maybe they proudly stated knowing the risks, and while unfortunate, risks became reality. And then everything is fine.

[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by natsucks on Thursday June 13, 2024 @11:53AM (#40671168)
I don't understand how this doesn't destroy a company. They willfully ingored a serious risk and it had major national security implications.
[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by dfedbeef on Thursday June 13, 2024 @01:33PM (#40672327)
Have you tried to use Google customer support
[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by red_admiral on Thursday June 13, 2024 @11:18AM (#40670751)
Wasn't there something a bit like that with the Morandi bridge that collapsed in Italy?

(There was definitely something like that with the Mottarone cable car that had been running for years with the safety catch disabled. When the tow-rope snapped, wiht no catch, the cabin rushed down and killed everyone on board.)

[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by delfinom on Thursday June 13, 2024 @12:07PM (#40671394)
>What is different in our industry that companies (and managers) get away with such malice?

Lack of professional licensure that binds you to state regulation with jail time as one of the stated punishments besides financial liability.

Heh, the government could start effecting change by mandating licensure and sign-offs by licensed individuals when contracting for software products sold to the government.

[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by johnnyanmac on Thursday June 13, 2024 @01:20PM (#40672213)
Boeing in a nutshell.

>What is different in our industry that companies (and managers) get away with such malice?

Software isn't immediately life threatening. That's why it's all thr wild west outside of medical and aerospace. While it sucks to have PI leaked to the internet, you do have time to at least take action compared to a door in an airplane coming off.

[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by hanniabu on Thursday June 13, 2024 @04:06PM (#40674058)
> Software isn't immediately life threatening

being a boeing whistleblower is though

[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by pompino on Thursday June 13, 2024 @02:55PM (#40673227)
So software developers should be criminally liable for introducing security bugs?
[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by ycombinatrix on Thursday June 13, 2024 @04:10PM (#40674108)
knowingly? yes.
[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by pompino on Thursday June 13, 2024 @04:33PM (#40674380)
What standard do you suggest to prove intent?
[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by YoshiRulz on Thursday June 13, 2024 @09:31PM (#40676704)
How about the same as for fraud, manslaughter, conspiracy... But that's the judiciary's problem anyway. People who campaign for this higher accountability argue that it's such a drastic change from fines that it will change company cultures overnight.
[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by pompino on Friday June 14, 2024 @12:02AM (#40677383)
A policy proposal needs a legal framework under which can actually can work. You can't just push that off as "that's the judiciary's problem".
[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by RevEng on Thursday June 13, 2024 @08:36PM (#40676410)
Management that knowingly chooses to ignore a major issue should be charged with criminal negligence. The creation of the bug is a common and difficult to avoid mistake. But once it has been found, choosing not to change it despite being warned if the consequences makes you responsible for those consequences.
[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by pompino on Thursday June 13, 2024 @08:54PM (#40676507)
So if send an email "Fix all your bugs or else bad stuff will happen", and if they don't fix all their bugs now I can put their devs in jail ?
[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by YoshiRulz on Thursday June 13, 2024 @09:24PM (#40676673)
Don't be obtuse. That is obviously not a genuine bug/vuln disclosure.
[ Parent | on HN ]
Re:Microsoft Chose Profit over Security, Whistleblower Says by pompino on Thursday June 13, 2024 @11:53PM (#40677355)
And you decide what is genuine?

Sorry, this whole thread is a fantasy of nerds thinking they can create a punitive policy for behavior they don't like. But there is no actual substantive framework under which any of these fantasies can come true.

[ Parent | on HN ]