Admining an MS shop is like “haha yeah isn’t it great? all these tools! so great!” dies on inside knowing all these tools are tied into cloud infra that we’ve had to assume is unsafe ever since SolarWinds, can’t challenge anything because your boss saw a list of open source CVE’s and isn’t aware there isn’t a similar database for how many foreign governments and criminal enterprises have backdoors in Azure

Good thing no one is putting anything important in azure, like core banking services…

Oh no!

Anyway, here’s your annual 10% increase in service cost because “there is no alternative”

Microsoft is in the business of making their users (of paid software) their beta testers so they don’t have to pay for actual beta testers. This was made obvious from their track record in recent years of bad Windows updates (that you’re not allowed to refuse) which resulted in bricked computers and/or data loss. Numerous incidents of this within the last 5 years alone, some were on the Insiders builds (which one would still expect to not have these problems given those are release candidate builds and not supposed to be actual beta builds) but some incidents were with actual release builds. They also have more telemetry in their production software than a lot of companies have in their beta software, but that’s more because they can directly make money off that data.

So remember: when you buy a Microsoft product, you’re paying for the privilege of testing their code in your own live production environment.

This is the best summary I could come up with:

We follow an extensive process involving a thorough investigation, update development for all versions of affected products, and compatibility testing among other operating systems and applications.

Tenable is discussing the issue in only general terms to prevent malicious hackers from learning how to actively exploit it in the wild.

It is for this reason that we are withholding all technical details.” While Yoran’s post and Tenable’s disclosure avoid the word vulnerability, the email said the term is accurate.

The post came on the same day that security firm Sygnia disclosed a set of what it called “vectors” that could be leveraged following a successful breach of an Azure AD Connect account.

“The default configuration exposes clients to the described vectors only if privileged access was gained to the AD Connect server,” Ilia Rabinovich, director of adversarial tactics at Sygnia, wrote in an email.

Both Tenable and Sygnia said that the security vulnerabilities or vectors they disclosed weren’t related to the recent attack on Microsoft cloud customers.

I’m a bot and I’m open source!