Microsoft is pivoting its company culture to make security a top priority, President Brad Smith testified to Congress on Thursday, promising that security will be “more important even than the company’s work on artificial intelligence.”

Satya Nadella, Microsoft’s CEO, “has taken on the responsibility personally to serve as the senior executive with overall accountability for Microsoft’s security,” Smith told Congress.

His testimony comes after Microsoft admitted that it could have taken steps to prevent two aggressive nation-state cyberattacks from China and Russia.

According to Microsoft whistleblower Andrew Harris, Microsoft spent years ignoring a vulnerability while he proposed fixes to the “security nightmare.” Instead, Microsoft feared it might lose its government contract by warning about the bug and allegedly downplayed the problem, choosing profits over security, ProPublica reported.

This apparent negligence led to one of the largest cyberattacks in US history, and officials’ sensitive data was compromised due to Microsoft’s security failures. The China-linked hackers stole 60,000 US State Department emails, Reuters reported. And several federal agencies were hit, giving attackers access to sensitive government information, including data from the National Nuclear Security Administration and the National Institutes of Health, ProPublica reported. Even Microsoft itself was breached, with a Russian group accessing senior staff emails this year, including their “correspondence with government officials,” Reuters reported.

  • reversebananimals@lemmy.world
    link
    fedilink
    English
    arrow-up
    227
    ·
    6 months ago

    To reinforce the shift in company culture toward “empowering and rewarding every employee to find security issues, report them,” and “help fix them,” Smith said that Nadella sent an email out to all staff urging that security should always remain top of mind.

    Yeah that ought to do it.

    • WhatAmLemmy@lemmy.world
      link
      fedilink
      English
      arrow-up
      172
      ·
      6 months ago

      Lol. Considering it was senior management that ignored staff, this statement is even fucking dumber than it sounds.

    • schizo@forum.uncomfortable.business
      link
      fedilink
      English
      arrow-up
      91
      ·
      6 months ago

      That’s just barely thoughts-and-prayers level. They could at least schedule a mandatory meeting that interrupts everyone’s day for half an hour.

        • herrcaptain@lemmy.ca
          link
          fedilink
          English
          arrow-up
          49
          arrow-down
          1
          ·
          6 months ago

          Using the hotline won’t get you fired, but somehow - for totally unrelated reasons - after using it you’ll end up on a PIP with untenable goals, and that will get you fired.

    • Cosmo@lemmy.world
      link
      fedilink
      English
      arrow-up
      31
      ·
      6 months ago

      "Of course, fixing these kinds of issues won’t push your product deadlines back at all. But we’ll be thankful to you! "

    • Emotet@slrpnk.net
      link
      fedilink
      English
      arrow-up
      23
      ·
      6 months ago

      Same energy as “You have unlimited PTO here, but we also have this nifty little thing called performance metrics”

      • rem26_art@fedia.io
        link
        fedilink
        arrow-up
        8
        ·
        6 months ago

        they could throw a pizza party for their government clients. Less work than fixing the problem

    • demizerone@lemmy.world
      link
      fedilink
      English
      arrow-up
      25
      ·
      edit-2
      6 months ago

      Well recall is why they’re so focused on security now. They want to host every detail of your life. They can’t do that now because their platform is a tire fire.

        • Lost_My_Mind@lemmy.world
          link
          fedilink
          English
          arrow-up
          10
          arrow-down
          1
          ·
          6 months ago

          Eh…Windows 3.1, 95, 98SE, XP, and 7 were all pretty great.

          They HAVE released some hot trash. I don’t even remember Vista. I just remember it’s trash.

          • Dave.@aussie.zone
            link
            fedilink
            English
            arrow-up
            17
            ·
            6 months ago

            Eh…Windows 3.1, 95, 98SE, XP, and 7 were all pretty great.

            From a user interface perspective, they were okay, perhaps because by the time people got to XP they’d had a decade of a consistent interface and were just used to its quirks.

            From a security context they were not ok. Not ok at all.

            • Lost_My_Mind@lemmy.world
              link
              fedilink
              English
              arrow-up
              5
              arrow-down
              2
              ·
              6 months ago

              I genuinely don’t know if I left my firewall on or off the last time I fiddled with it, on my Windows 7 machine.

              That was like 10 years ago. It’s still my daily use pc. Zero antivirus. Just firefox which was installed 10 years ago. And ad block orgin which was also installed 10 years ago but updated over the years.

              Oddly enough, the only website I have issue with is lemmy.

          • AbidanYre@lemmy.world
            link
            fedilink
            English
            arrow-up
            3
            ·
            6 months ago

            Was it 95 that you could hit cancel at the log in screen and it would let you skip putting in a password?

            Sure it looked pretty, but security was a disaster.

            • Joe Cool@lemmy.ml
              link
              fedilink
              English
              arrow-up
              4
              ·
              6 months ago

              Oh, lemmy has cakes. Happy cake day.

              That password was only for network shares/NT domains. 95 didn’t have any concept of users, like DOS.

            • Rai@lemmy.dbzer0.com
              link
              fedilink
              English
              arrow-up
              3
              ·
              6 months ago

              In 98 you could use the accessibility settings in the login page to bypass account password too!

              • Joe Cool@lemmy.ml
                link
                fedilink
                English
                arrow-up
                5
                ·
                6 months ago

                I just pressed cancel. Who needs network shares.
                On XP you could start the On Screen Keyboard, open the help for that and then open the explorer by browsing for a different help file.

                MS has a history of security first.

    • Dudewitbow@lemmy.zip
      link
      fedilink
      English
      arrow-up
      88
      arrow-down
      7
      ·
      6 months ago

      you can have a propietary os thats secure, but the problem is once you get to the point where youre selling data and allow anything to be installed of course, its no longer secure.

      • tabular@lemmy.world
        link
        fedilink
        English
        arrow-up
        35
        arrow-down
        16
        ·
        edit-2
        6 months ago

        You can’t verify it’s secure if it’s proprietary, so it’s never secure? Having control over other people’s computing creates bad incentives to gain at your user’s expense, so it’s day 1 you should lose trust.

          • tabular@lemmy.world
            link
            fedilink
            English
            arrow-up
            12
            arrow-down
            9
            ·
            6 months ago

            That just moves requiring trust from the 1st party to 2nd or 3rd party. Unreasonable trust.

              • circuscritic@lemmy.ca
                link
                fedilink
                English
                arrow-up
                21
                ·
                edit-2
                6 months ago

                Wait…you don’t audit every package and dependency before you compile and install?

                That’s crazy risky my man.

                Me? I know security and take it seriously, unlike some people here. I’m actually almost done with my audit and should be ready to finally boot Fedora 8 within the next 6-8 months.

              • tabular@lemmy.world
                link
                fedilink
                English
                arrow-up
                6
                arrow-down
                6
                ·
                edit-2
                6 months ago

                This is like asking if you do scientific experiments yourself or do you trust others’ results. I distrust private prejudice and trust public, verifiable evidence that’s survived peer review.

                • TropicalDingdong@lemmy.world
                  link
                  fedilink
                  English
                  arrow-up
                  19
                  arrow-down
                  1
                  ·
                  edit-2
                  6 months ago

                  Scientists in the room who have to base their experiments off other peoples data and results:

                  Tongue in cheek but this is actually giving me particular headache because of some results (not mine) that should have never been published.

        • Dudewitbow@lemmy.zip
          link
          fedilink
          English
          arrow-up
          11
          ·
          edit-2
          6 months ago

          id argue arguing the unknown can’t be used to say if its technically secure, nor insecure. If that kind of coding is brought into place, then say any OS using non open source hardware is insecure because the VHDL/Verilog code is not verifiable.

          Unless everyone running an open source version of RISC-V code or a FPGA for their hardware, its a game of goalposts on where someone puts said flag.

          • tabular@lemmy.world
            link
            fedilink
            English
            arrow-up
            2
            arrow-down
            1
            ·
            edit-2
            6 months ago

            Consider people counting paper votes in an election. Multiple political parties are motivated by their own self interests to watch the counting to prevent each other faking votes. That is a security feature and without it then the validity of the election has a critical unknown making it very sussy.

            An OS using proprietary software is like as an electronic voting machine, we pretend it’s secure to feel better about a failing we can’t change.

            • Dudewitbow@lemmy.zip
              link
              fedilink
              English
              arrow-up
              2
              ·
              edit-2
              6 months ago

              the problem is the bad actors have direct access to said voting machines. in the case of security, the people creating the OS is not the bad actor typically in question when you think of bad actors, which kind of goes back to the goalpost situation. Unless you knew how everything is designed from the ground up (including the hardware code in whatever language it is) then thats just setting an arbitrary goalpost. basically typical NSA backdoor, or foreign backdoor via hardware situation, independent of the OS. To bluntly place it only at the OS stage is setting said goalpost there when you can really apply it to any part of the line (the chip design, the hardware assembler, the os designer, the software maker). Setting it at the OS level fundamentally means all OS’ are insecure by nature unless you’re actively running it on a FPGA thats constantly getting updates.

              For instance, any CPU with speculative programming fundamentally is insecure and is virtually in all modern processors. never even mind the CPU when the door is already open regardless of the OS.

              • tabular@lemmy.world
                link
                fedilink
                English
                arrow-up
                3
                ·
                6 months ago

                When I think of bad actors and software I think of security from 3rd parties after the intentions of the authors. Not just security but also privacy and any other anti-features users wouldn’t want. That applies to the OS, apps or drivers. Hardware indeed has concerns like software, which is just a wider conversation about security, which is just part of user/consumer rights.

        • TORFdot0@lemmy.world
          link
          fedilink
          English
          arrow-up
          7
          ·
          6 months ago

          I mean you can provide audit findings and results and it’s a pretty big part of vendor management and due diligence but at some point you have to accept risk in using open source software that can be susceptible to supply chain hacks, might be poorly maintained, etc or accept the risk of taking the closed source company’s documentation at face value (and that can also be poorly maintained and susceptible to supply chain attacks)

          There’s got to be some level of risk tolerance to do business and open source doesn’t actually reduce risk. But it can at least reduce enshittification

          • cybersandwich@lemmy.world
            link
            fedilink
            English
            arrow-up
            10
            arrow-down
            3
            ·
            6 months ago

            It’s pretty hilarious when people act like being open source means it’s “more secure”. It can be, but it’s absolutely not guaranteed. The xz debacle comes to mind.

            There are tons of bugs in open source software. Linux has had its fair share.

            • PopOfAfrica@lemmy.world
              link
              fedilink
              English
              arrow-up
              12
              ·
              6 months ago

              The XZ thing is actually a great point to open source’s favor. All it took was some dude to figure it out.

              If you try to inject maligned code, you will be found out. That can’t happen with proprietary software.

              • cybersandwich@lemmy.world
                link
                fedilink
                English
                arrow-up
                2
                ·
                edit-2
                6 months ago

                It highlighted some pretty glaring weaknesses in OSS as well. Over worked maintainers, unvetted contributers, etc etc.

                The XZ thing seems like we got “lucky” more than anything. But that type of attack may have been successful already or in progress elsewhere. It’s not like people are auditing every line of every open source tool/library. It takes really talented devs and researchers to truly audit code.

                I mean, I certainly couldn’t do it for anything semi advanced, super clever, or obfuscated the way the XZ thing was.

                But I agree, that the fact we could audit it at all is a plus. The flip side is: an unvetted bad actor was able to publish these changes because of the nature of open source. I’m not saying bad actors can’t weasel their way into Microsoft, but that’s a much higher bar in terms of vetting.

            • tabular@lemmy.world
              link
              fedilink
              English
              arrow-up
              3
              ·
              edit-2
              5 months ago

              Proprietary software has to be caught being insecure to be “guilty of” being insecure. Free software can be publically verified, effectively “proven innocent” - a much higher standard.

      • TWeaK@lemm.ee
        link
        fedilink
        English
        arrow-up
        3
        ·
        6 months ago

        That’s the crux of it here. Microsoft wanted to get into the data game they saw Facebook and Google reaping. However, Microsoft still charge you for the software they use to harvest your data.

    • Cosmo@lemmy.world
      link
      fedilink
      English
      arrow-up
      13
      arrow-down
      2
      ·
      6 months ago

      I mean what they have to do is obvious, right? Only one of these two options can help increase ad revenue.

  • xenomor@lemmy.world
    link
    fedilink
    English
    arrow-up
    70
    ·
    6 months ago

    My suggestion, based on more than three decades of observing and interacting with this company: don’t believe a fucking thing they say, ever.

  • Tylerdurdon@lemmy.world
    link
    fedilink
    English
    arrow-up
    58
    arrow-down
    1
    ·
    edit-2
    6 months ago

    “Microsoft is pivoting its company culture to make security a top priority…”

    The fact that this had to be stated is a testament to garbage leadership. Notice it’s not even the top priority, just a top priority. These guys will still get bonuses of course.

    • deweydecibel@lemmy.world
      link
      fedilink
      English
      arrow-up
      13
      ·
      6 months ago

      The security will definitely also take a very profitable shape. I.e. further locking the OS away from the user, more black box software, etc.

  • tootoughtoremember@lemmy.world
    link
    fedilink
    English
    arrow-up
    47
    arrow-down
    2
    ·
    6 months ago

    Too late. Linux is going from my hobby project to my primary OS by the time they stop providing Windows 10 updates, if not sooner.

    • tomten@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      ·
      6 months ago

      Thats what I did when win 7 support was ending, been very happy and there’s no way I’m going back to Windows.

  • NutWrench@lemmy.world
    link
    fedilink
    English
    arrow-up
    40
    ·
    6 months ago

    If Microsoft cares so much about security, then WTF are they doing greenlighting a project like CoPilot / Recall?

    • EnderMB@lemmy.world
      link
      fedilink
      English
      arrow-up
      9
      ·
      6 months ago

      Like most big tech companies, they’re actually several divisions all competing with each other. Lately, the AI divisions have latched on to the hype and they’re pushing their wares to other divisions, often with enough clout to keep those in security/privacy quiet. Integrating LLM’s is also a great way for a middle manager type to curry favour with the bosses, and to build little empires for themselves.

    • Phoenixz@lemmy.ca
      link
      fedilink
      English
      arrow-up
      3
      ·
      6 months ago

      Microsoft cares so much about security

      Are you kidding? I’ve known Microsoft as a shitty software vendor that gives a rats ass about security for over 40 years now. Microsoft never has cared about security, it’s a running gag at this point

    • capital@lemmy.world
      link
      fedilink
      English
      arrow-up
      2
      ·
      6 months ago

      Businesses that buy the enterprise versions of their software can disable those features in policy.

      They are far less concerned with your security than their paying customers: businesses.

    • UnderpantsWeevil@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      arrow-down
      1
      ·
      6 months ago

      Its part of their large scale automation strategy, wherein they gobble up as much of the business practices of an organization’s staff as possible and then offer to provide “AI Employees” who replicate the logic of human staffers at a discounted price.

  • bdot@lemmy.world
    link
    fedilink
    English
    arrow-up
    35
    ·
    6 months ago

    no they won’t. these pricks literally fired their entire AI Ethics team… that tells you everything you need to know about where their priorities are.

    the only thing they are gonna do about this is figure out a way to make people not angry, but continue to fo as much shady shit as they can.

  • Optional@lemmy.world
    link
    fedilink
    English
    arrow-up
    36
    arrow-down
    2
    ·
    6 months ago

    I’ve spent the better part of my life watching microsoft fuck people over and then when they finally - finally get called out on it they do a bunch of bashful aw-shucksing before doing it again and again and again.

    No.

    Microsoft is dead. Kill it with fire. The US government should have known better, but they didn’t because like every other organization they have a boatload of clueless mid-level managers who only every learned Windows and fall for microsoft’s garbage every time, despite the eye-popping price.

    NO MICROSOFT. EVER. They’re a criminal organizaiton, the amount of destruction they’ve created will never be known.

  • Taleya@aussie.zone
    link
    fedilink
    English
    arrow-up
    31
    arrow-down
    1
    ·
    edit-2
    6 months ago

    the funniest part of the fall of MS for me has been the cunts getting so excited about fucking off the home users they forgot one vital thing: C-suite and beancounters run at a home user level. And most infrastructure techs will happily flick to a linux distro come server build time.

    Their current direction has also pretty much killed their use in anything related to media distribution, it’s virtually a detailed list of TPN violations

    • deweydecibel@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      edit-2
      6 months ago

      a detailed list of TPN violations

      Eh, that’s actually kind of a selling point. I’ve got no interest in an OS on my personal PC that focuses on being made more friendly to the MPA.

  • kippinitreal@lemmy.world
    link
    fedilink
    English
    arrow-up
    30
    ·
    edit-2
    6 months ago

    Microsoft focused on security at this point is like a builder focusing on building strong foundations now that the house is built on top.

    It’s a little too late my dudes.

    • Tinidril@midwest.social
      link
      fedilink
      English
      arrow-up
      16
      ·
      6 months ago

      I remember them saying all the same exact things in the early 2000s after a slew of widespread disasters. Security will never be a higher priority than whatever cool new thing they want to sell.

    • Maeve@sh.itjust.works
      link
      fedilink
      English
      arrow-up
      5
      ·
      6 months ago

      It would take ripping apart and rewriting hundreds of thousands of lines of source code, if not millions. Not just bloat from one off bright ideas, that led to the next bright ideas, but the deliberate obsfucation to protect proprietary code, in more instances than I can imagine. I’m not a programmer, so I could be wrong, obviously, but from my admittedly limited perspective, they’d be better off writing a whole new OS without all the built-in garbage nobody wants.

      • kippinitreal@lemmy.world
        link
        fedilink
        English
        arrow-up
        4
        arrow-down
        1
        ·
        6 months ago

        I think Windows 11 was supposed to be that clean break. They’ve reimplemented a lot of core functionality compared to XP & 7. If they’re still getting breached then they obviously aren’t serious about security.

  • meseek #2982@lemmy.ca
    link
    fedilink
    English
    arrow-up
    26
    ·
    6 months ago

    According to Microsoft whistleblower Andrew Harris, Microsoft spent years ignoring a vulnerability while he proposed fixes to the “security nightmare.” Instead, Microsoft feared it might lose its government contract by warning about the bug and allegedly downplayed the problem

    This says everything about this shitty company. Worst of the worst. Because that’s how they make 90% of their cash. By exploiting licensing deals and siphoning data to sell to whomever because they do not care who it is so long as they bid the highest.

    It’s amazing no one has tried to break up their control over PCs. Make this world make sense.

  • Jayjader@jlai.lu
    link
    fedilink
    English
    arrow-up
    23
    ·
    6 months ago

    Microsoft is pivoting its company culture

    Oh yes, the thing they’re well known for succeeding at.