When I was at Microsoft we took security cripplingly seriously to the point we could not deliver features and our competitors could because the security process was convoluted and had multiple reviews and approval steps.

▲

Veserv 7 hours ago | parent | next [-]

Having crippling bureaucracy does not correlate with good security outcomes, except maybe negatively. However, having a history of unending egregious security failures, like Microsoft, does correlate with poor security outcomes. For that matter, having a present of unending egregious security failures also correlates with poor security outcomes.

Let us look on the front page and see if there are any, oh look here is one: https://www.binarysecurity.no/posts/2026/10/one-root-case

▲

keeda 7 hours ago | parent | next [-]

Having crippling bureaucracy does have better correlation with security outcomes than the “move fast, break things” philosophy that most of the software industry lives by.

I’m not even blaming Zuck for that, he didn’t really invent it, though he certainly popularized it — he just made an astute observation of the dynamics in software and turned it into a company motto.

▲

Veserv 7 hours ago | parent [-]

Neither is correlated with good security outcomes against the prevailing threat landscape of profit-motivated, commercial, professional attackers with tiny budgets of a few million dollars. The standard is not "better", it is "adequate".

▲

keeda 6 hours ago | parent [-]

Correlation is not an absolute measure here, it’s relative. As is the entire concept of security.

As is what constitutes the standard of “adequate.” Which BTW is the standard in ALL engineering (not just security or software) because we live in a world where economic pressures apply and costs must be managed. Trivial example: bridges only use an “adequate” amount of steel and concrete because they are not free. The word “adequate” fundamentally involves the concept of tolerances. There’s a reason we consider over-engineering a bad thing.

So which development approach would you say is better correlated with good security outcomes?

▲

Veserv 5 hours ago | parent [-]

Adequate is making it uneconomical, or cost ineffective, for threats to your organization to attack you either deliberately or indiscriminately. Absent a specific organization, we can use a profile of commonplace, prevailing threats as a proxy. A profile of commonplace threats is, as I said before, a profit-motivated, commercial, professional group seeking a multi-million dollar payout and thus being profitable at a cost of a few million dollars per commercial target. That is "adequate" in the prevailing threat landscape if you are the "average" organization.

	▲	keeda 3 hours ago \| parent [-]
		That is a great definition of adequate for security! My point is that at scale, bureaucracy is a necessary (though not sufficient!) condition for achieving adequate security. Another way to look at it is, bureaucracy is an aspect of the corporate culture, and lasting security comes down to having the right culture. At least in that respect Microsoft is doing something right. Doubtlessly a lot of that bureaucracy is ineffective, but it's a signal that the cultural intention exists. As a relevant counterexample, we've never heard of these kind of processes at Meta and so you get Cambridge Analytica. My perspective is skewed by my experience being on a security-adjacent platform team for years. Our biggest challenge was not external threats, it was internal teams seeing us as friction on their productivity, to the extent that it regularly led to escalations. So when Cambridge Analytica happened, I played it up for all it's worth; Meta may move fast because they didn't have our "bureuacratic team", but look where it got them! Unfortunately the $25B penalty happened just last week... I'd have gotten infinite political mileage out of that.

▲

whimsicalism 7 hours ago | parent | prev [-]

the only reason you’re seeing this post is because of the large bug bounty program that actors like Northflank don’t even operate

	▲	Veserv 7 hours ago \| parent [-]
		I do not see how that is relevant. Are you saying that trivial cross-tenant compromises are not egregious security failures demonstrating their systems are unfit for purpose because other companys make products that have even more egregious security failures that are even more unfit for purpose? My bridge that collapses is adequate and acceptable because other people make even worse bridges that collapse even easier? No, the bridge still collapses, everybody gets a F.

▲

tptacek 7 hours ago | parent | prev | next [-]

Practically every software security firm in the country was a vendor to Microsoft in the mid-late oughts and I know the Microsoft you're speaking about, but the vibe I've got lately is that things are different there now.

▲

loloquwowndueo 8 hours ago | parent | prev [-]

Tell me you weren’t on the Windows team without telling me you weren’t on the windows team :)