Microsoft rewarded for security failures with another US Government contract

https://www.theregister.com/2025/09/02/microsoft_rewarded_for_security_failures/

by rntn • 11 months ago

189 49 11 months ago

theregister.com

datadrivenangel• 11 months ago

Too big to fail sets us all up for failure.

belter• 11 months ago

Microsoft is the new Boeing.

IAmBroom• 11 months ago

Boeing isn't "too big to fail". That was used to describe the big banks at the middle of the Great Recession.

Boeing is "the only game in town". All other big-aircraft manufacturers are foreign.

ldayley• 11 months ago

This headline BADLY buries the lede! The real scary stuff is the massive future costs of the blatant vendor lock-in that ALL the big tech firms, including Microsoft, are banking on with “free to the government for a year, undisclosed terms for later” contracts.

wkat4242• 11 months ago

This is kinda the same for big enterprises too. They start off with really great deals, then every other part is "only a cheap addon, much cheaper than competing product XYZ". Then when you're completely stuck in the M365 swamp, that's when they turn the thumbscrews when the contract renegotiation comes up.

okanat4• 11 months ago

The thing is: Where is the competition though? Considering that most IT departments don't want to spend an extra dime to do consumer-grade software engineering to do any extra integration there is no significant competition to Microsoft 365 and Active Directory.

Google Workspace is the closest but it isn't even in the same playing field when comes into advanced integration. Microsoft killed all of its competition in 90s and early 00s. Nobody stopped them. Nobody applied antitrust law. Now they have at least a decade ahead of everybody else.

Any competition should have to spend quite a bit extra money to just move all the integrated apps (SAP, Salesforce, CAD software, Exchange extensions) to their environment. To repeat my point, most IT departments want to spend a whole 0 on developing / engineering integrated solutions and developing those require some millions per year at least. Microsoft sells these stuff as low as €20 per user depending on the contract.

Sysadminhell• 11 months ago

Just one more massive breach and Satya wins a mountain bike.

stalfosknight• 11 months ago

Why must the government and almost every corporation continue to reward Microsoft for their horseshit?

prerok• 11 months ago

Emm, they don't, but the price to switching is too high.

If everyone in their formative years would use Linux, then it would be a different story. But... they don't, so it requires reeducation. I think Mexico attempted it and I hope they were successful.

kube-system2• 11 months ago

Because a top-down management structure has advantages in delivery accountability, regulatory alignment, and scoping of risk.

A successful software implementation requires a lot more than just software.

Tearing out all MS software at any large organization would involve quite a bit of compromise and many opportunities for failure.

jiggawatts• 11 months ago

Do you think any other large software vendor is pure as the driven snow?

Oracle?

Google?

Broadcom?

neuroelectron• 11 months ago

As an A erican Dynamics 365 developer, I wonder if I qualify for these jobs, or is it only spies willing to do it for extremely low pay that get the job? Tbf, My boss charges $165 an hour for my time. Freelancers charge even more, of course.

chirau• 11 months ago

Maybe it's just me, but I do not get your point. Would you mind clearing it up?

charcircuit• 11 months ago

Microsoft rewarded for security failures

It was the government's security failure and not Microsoft's. Microsoft was up front about what was happening and the government could have pushed back if they did not approve of the digital escort system.

djhn• 11 months ago

Can you elaborate slightly? Digital escorts is a tough keyword pairing to search for regardless of additional context.

phonon• 11 months ago

https://news.ycombinator.com/item?id=44570363

SilverElfin• 11 months ago

Instead, the government should fund competition to lower prices. It seems like Office is still the default for everyone and it’s not really possible for anyone to hire thousands of engineers for a decade or two to compete with them. There’s no functioning competition for a product like this.

mattmaroon3• 11 months ago

Google, Apple, and various, other open and closed sourced alternatives exist for nearly everything in Office. Many of them have been under development for decades by companies that are similar in magnitude to Microsoft.

Lack of competition is definitely a problem in the pricing of some things, but I don’t think this is one of them, people just prefer what Microsoft offers and are willing to pay for it.

gjsman-1000• 11 months ago

LibreOffice, in the most primordial form, has been developed since 1985. It's older than Linux.

To be honest though, would I use it for my business? No. Broken formatting (for either my side or a client's side) isn't acceptable; the UI is two decades behind; LibreOffice Calc is still too incomplete; and who knows what's in a C++ codebase that old and that large (100,000+ files, 10M+ LoC) - it's basically security by obscurity. Microsoft Office getting hacked and fixed, is better than a target too small to matter until a government adopts it.

everforward• 11 months ago

In a narrow view, this is true, but from a wider viewpoint Microsoft has few competitors in the "one stop shop for your big business needs" sense.

Google has made some progress here, but doesn't seem interested in a bunch of important spaces (e.g. they have Docs, but don't have anything like Active Directory or Sharepoint that I know of).

Microsoft is also often the default vendor, since virtually every big company has contracts with them for Windows and Office (at least) already.

jongjong• 11 months ago

They could use Linux and Libre Office. The government doesn't actually require anything fancier than that.

A lot of the dependencies on advanced features are artificial. The government creates unnecessary rules/bureaucracy for itself such that only specific providers are able to meet those rules. Bureaucracy and regulations are designed to be anti-competitive and benefit large companies who fund the political campaigns.

The government really is oppressing one set of people to benefit another set of people. It has always been like this. Nothing changed fundamentally in the past 300 years except which group of people is being oppressed and which group is doing the oppressing.

IMO, the government should force major social media companies to allocate a portion of their ad space to the government for campaigns. So that anyone can run for office and can get enough attention in the media to build momentum, starting from nothing.

Anyway, the problem is deep and sits alongside a whole bunch of other problems. All greatly exacerbated by the design of the monetary system which gives the government access to unlimited money.

kazinator2• 11 months ago

Microsoft is rewarded for security, privacy and reliability failures each time a consumer buys another Windows PC.

And, to be fair, so is every other software project with an imperfect track record, that continues to have users, whether FOSS or closed source.

illusive4080• 11 months ago

Yeah I hate Microsoft as much as the next guy but every product has security vulnerabilities. If the product is popular enough, then hackers spend time discovering those vulnerabilities.

okanat4• 11 months ago

I don't use Linux as my primary OS anymore. However the default protections of the Linux desktop is worse than Windows's which is rather sad. For "root" level operations Windows has several layers to protect the system itself. The newer Appx packages are have scoped security protections around them.

On Linux, yes you can spend months modifying Flatpaks, or writing SELinux rules or apparmor profiles but nobody does that. The out-of-the-box Linux user distros are quite a bit lacking and it is only a matter of time that malware that steal secrets from home directory to arrive to Linux too.

c0balt• 11 months ago

On Linux, yes you can spend months modifying Flatpaks, or writing SELinux rules or apparmor profiles but nobody does that.

For what it's worth, RHEL and to some degree Fedora do give you those SELinux rules for most of their packages. That OOB for anything you would install with rpm.

it is only a matter of time that malware that steal secrets from home directory to arrive to Linux too.

No need to wait? Most of the malware distributed over npm/pypi has supported Linux and sometimes MacOS for a long time.

dhx3• 11 months ago

Windows has AppContainers which is for the most part a wrapper around the Windows Kernel Mandatory Integrity Level (MIL) feature.[1][2] MIL restricts certain API calls of processes depending on the integrity level of the current process vs. integrity level of a target process for the API call. The idea being a process with a low integrity level wouldn't be able to read or write via IPC to a process with a high integrity level. The process with a high integrity level would instead need to read or write via IPC to the process with a low integrity level.[3]

Because there are obvious architectural limitations of having a linear scale of privilege levels which one places all processes on, Windows has tried implementing "Windows Sandbox" as an alternative sandboxing mechanism that executes a process in a Hyper-V virtual machine that has restrictions placed on the interfaces exposed into the virtual machine.

I believe Windows Kernel still doesn't have any similar functionality to Linux's namespaces that are much more capable and flexible with sandboxing applications. The reason I recall is Windows' GDI subsystem (painting/drawing) being implemented within the Windows Kernel, not a userspace process as you see with Wayland compositors on Linux systems. This GDI subsystem I believe was the main problem holding back the Windows Kernel from implementing Linux-like namespace and sandboxing functionality.

Linux and common desktop environments such as Gnome also offer sandboxing out-of-the-box in more ways than a typical Windows installation, including as examples:

- very granular seccomp filters implemented for system processes (typically via the simple and accessible method of systemd service configuration) to only permit a process to make certain syscalls or access only specific system resources (files, network interfaces, etc)

- seccomp filters for revoking permissions on processes once they've started up and no longer need certain permissions. See for example OpenSSH and how it forks into less privileged processes once ports have been opened, keyfiles read, etc.

- Use of multi-process application architectures where each process is individually sandboxed, where a Windows equivalent would be a monolithic application. See for example use of "glycin" in Gnome applications for parsing and loading images in separate sandboxed processes from other parts of the application[4], or "tracker" again in Gnome applications which sandboxes the processes for metadata extraction from each file.

[1] https://learn.microsoft.com/en-us/windows/security/book/appl...

[2] https://learn.microsoft.com/en-us/windows/apps/windows-app-s...

[3] https://learn.microsoft.com/en-us/previous-versions/dotnet/a...

[4] https://gitlab.gnome.org/GNOME/glycin

edit: some references added

photon_lines2• 11 months ago

I'm about to say goodbye to Windows forever -- and it has nothing to do with their security vulnerabilities. It has to do with 1) the incredibly shitty software they produce (Windows 11) and 2) their lack of ethics in regards to pretty much everything. I'm about to go all in on Linux - I've been using both OSes for years now but Linux to me today is the superior choice and I see 0 reason why anyone would want to touch Windows (and I hope to god many developers follow me) -- Windows is an absolute atrocity.

anonymousiam2• 11 months ago

I'm with you 100%.

I'm typing this on a computer that came with Windows 11. I booted it a few times, and reserved a terabyte of my (8TB) SSD for it, but I never use it at all. I've got some Windows VMs, from XP through 10 that I rarely use, but I use them when needed for things that require those platforms.

I got an email from Intuit two weeks ago informing me that they weren't going to support Windows 10 anymore, so I guess I'll be deleting my Windows 10 VM soon, but I have no intention of ever creating or running a Windows 11 VM, or installing anything important on the soon-to-be-deleted Windows 11 partition I have, so I guess I'll quit using TurboTax after 40 years of using it.

I looked into the possibility of running TurboTax with Wine (or CrossOver, for which I have an eternal license), but apparently it doesn't run at all there.

buyucu• 11 months ago

Nobody who cares about security uses Microsoft or Windows.

TheNewsIsHere2• 11 months ago

I’ve been chatting with my cofounders about plotting a course out of Microsoft 365 and Azure AD/Entra ID.

Current working strategy is to first move everything using Entra SSO to our own hosted IdP, and then everything else. From there we’re thinking we move SharePoint/OneDrive, and replace the Office apps with LibreOffice (maybe Collabora?), and eventually replacing email with Fastmail, which we already resell.

We’re a managed hosting firm with a few technologists, and we have no external MS365 collaborators, so we’re a good fit for that kind of setup.

aussiedude2• 11 months ago

Which iDP are you thinking?

Also how’s fastmail with calendar invites to companies on exchange? What would you use to replace teams? Zoom?

TheNewsIsHere2• 11 months ago

Keycloak, most likely. We have experience with it.

Fastmail’s calendar invitation support is solid in my experience. And they support access via standard protocols. That is very quickly disappearing with Microsoft 365.

We never used Teams. Once we had the option to switch to non-Teams 365 licenses we did that almost immediately. We used to use Slack, but saw the writing on the wall when Salesforce acquired it, moved to Mattermost in Kubernetes, then Mattermost Cloud’s paid tier when it launched. When Mattermost evicted non-enterprise licenses from their cloud service we never replaced it. Turns out, we don’t really need an internal chat/conferencing app. We’re a few guys within a half hour of each other. If we need to, we hop on a call, send an email, or send a text to schedule a in-person meeting.

Microsoft rewarded for security failures with another US Government contract

Related Stories