Bognar

Per Microsoft's write-up:

> Storm-0558 acquired an inactive MSA consumer signing key and used it to forge authentication tokens for Azure AD enterprise and MSA consumer to access OWA and Outlook.com. All MSA keys active prior to the incident – including the actor-acquired MSA signing key – have been invalidated. Azure AD keys were not impacted. The method by which the actor acquired the key is a matter of ongoing investigation. Though the key was intended only for MSA accounts, a validation issue allowed this key to be trusted for signing Azure AD tokens. This issue has been corrected.

So the attackers found a valid private key for MSA (undetermined how, the theory was that it was scraped from a debug dump that was moved from high privilege prod to someone's low privilege shared drive). They then used that key to sign invalid tokens for AAD and the validating side incorrectly accepted those tokens. In this case, the validating side would be Exchange / OWA. Azure AD seems to not be implicated in the security issues, since it was MSA that leaked the key and OWA that failed to properly validate it.

That's my interpretation of the text anyway. It also aligns with my own understanding from a brief time at MS that Azure is much better at security than the rest of MS and that Exchange is a dumpster fire because of decades of cruft and evolution of systems.

Aborting threads has issues in most languages. Timing out an operation however is a solved problem with many safe implementations.

> Is there a phrase that means the opposite of "attention to detail?" Every little detail is a shitshow

I've used "fractally fucked" before, which I think is nicely evocative of how something is messed up at every level of detail.

3 of those are about Exchange and one is about Bing (involving AAD, but it was an AAD app that was misconfigured and not an AAD issue itself). The teams that run Azure are in entirely separate organizations with wildly different product stacks.

Exchange has a bunch of decades old infrastructure and is a security nightmare afaik. Dunno much about Bing.

The "org chart" graphic with MS orgs all pointing guns at each other is real shit. Different orgs have very different security postures, and Azure's is much stronger than others.

Source: spent some time at MS

I discovered option D during covid and it's like a superpower. I have allergies even through double dosing OTC medicine, but a good mask does wonders for me in spring.

I think I've seen that in every contract I've ever signed.

I heard a different variant of this, which is that Jim Koch the brewer at Sam Adams is a functioning alcoholic who drinks a lot throughout the day. The yogurt and yeast is an unrelated thing that he claims to work.

We don't have any conclusive evidence about the universe's finitude nor its discreteness.

There's a more unfortunate interpretation, which is that whoever can afford the travel and time to not be at work is more likely to qualify. I know a fencer who was in his mid 20s consistently placing top 3 in every tournament he went to and was Olympics material (based on who he was competing with and which of them did go to the Olympics). However, he didn't make the cut because the points system rewarded presence at more tournaments higher than placement and he had a job to keep showing up at.

Can you take the snappy one liners back to Twitter? Or at least try to have them make sense.

Guilt isn't necessary to be annoyed at someone's word choice. The chosen words are presenting an implication that eating animals is morally wrong, and if someone doesn't believe that and eats animals then they are right to be annoyed by the implication that they are acting immorally. No guilt necessary.

CloudFlare has some TCP proxying features, but most of what you actually get from adopting CF (or any CDN) requires decrypting traffic because most of the features depend on understanding the HTTP requests.

Who is being personally attacked? The first owner who decided to flay a human corpse and wrap their personal items with it? I think "sick" is an appropriate adjective.

Flat taxes are inherently regressive as the poor have to spend a higher proportion of their money than the rich in order to live.

It's not at all the same thing? Also there's a more apt comparison, which is forcing Google to make Android open and allow alternative app stores (oh wait, they already do).

App stores are a natural monopoly. An app store with more users attracts more developers. An app store with more apps attracts more users. It has a strong network effect and economies of scale. Natural monopolies should be regulated to prevent abuse by the first companies that capture wide market share.

If you're using GHA to publish then you still need a trusted branch to provide secrets to. If you're not publishing using CI, then you can still upload to PyPI manually with an API Token.

> without needing to give microsoft total access to uploading to pypi

I assume you're referring to Trusted Publishers here? It's a per-project configuration using the industry standard of OIDC that you don't have to opt in to, so "total access" is a silly characterization. Also if you're insinuating that MS is going to generate fraudulent OIDC tokens to compromise a PyPI package, then you might want to start weaning yourself off the kool-aid.

Ah yes, because version control is only about file storage.

Having worked at GitHub, we used MySQL because we've always used MySQL. It works because the business depends on making it continue to work, and switching off at this point is a multi-year effort. Herculean efforts have gone into scaling MySQL, and that is not without its own issues (outages, maintenance cost, etc.).

Isolation level consistency is not a problem I heard anyone talk about, but that's probably because most devs interact with the database via Active Record which is not exactly known for its transactionality guarantees (and is, of course, a source of yet another set of problems).

Part of being a freelancer is spending time finding work and doing a variety of things that clients would consider non-billable but still cost time. If you're going to work 40 hours a week, not all 40 will typically be billable in freelancing.

Provenance artifacts via something like SigStore would go a long way, since it solves both key management and the linking of artifacts to their build process.

For Go where you're just publishing sources with a build necessarily, you could opt for SigStore git signing so you can at least validate the author via a 2FA auth provider's OIDC token.

How do you validate that you're on a machine running secure boot? How about when you connect remotely?

Secure Boot also validates UEFI Option ROMs, not just bootloaders.

How far up the stack does the verification go? Most secure boot stacks give up after the initramfs because disk images are usually mutable. Do you make any attempts to go further?

I'm always curious what threat model that is valid against TPMs is not also valid against CPUs and main memory.

You can only extract the encryption key if using the unencrypted APIs. You can establish and require an encrypted channel with the TPM if you know which TPM you are expecting.

Mid-level backend engineer? Buy the book "Designing Data-Intensive Applications" and read it.

I love this analogy, interest rates on tech debt. It's such a natural extension of the phrase tech debt and succinctly gets a point across. I'm gonna have to steal that and start using it at work.

How do you deal with the same in Photoshop?

For both reasons mentioned above, yes. Even internally, many teams in Microsoft are shipping containers on Linux for prod services.

Azure is also the big moneymaker, so these days they want all their technologies to have Linux support since that's the dominant cloud OS.

Microsoft uses C# internally and has a vested interest in making it better for all of its own developers, as well as making it good to increase industry adoption so it has a larger pool of skilled developers to hire from. Your arguments about who backs the language don't hold water.