←back to thread

Microsoft Dependency Has Risks

(blog.miloslavhomer.cz)
153 points ArcHound | 1 comments | 25 Jun 25 20:08 UTC | HN request time: 0.439s | source
Show context
ArcHound ◴[26 Jun 25 05:16 UTC] No.44384369[source]▶
Hello, author here. The main point is that it's not a financially rational decision to ditch Microsoft.

There's just no real alternative for businesses, as most use AD, Teams, Outlook/Exchange and couple others.

replies(1): >>44384927 #
lmm ◴[26 Jun 25 07:03 UTC] No.44384927[source]▶
I don't think expected value is the right way to evaluate this. All insurance is negative expected value (that's how insurance companies make a profit), but businesses find it rational to buy insurance.

Also I'd say your risk of getting cut off is much more than 1 in 2 million, because there's nothing to say this can only be done to one company at a time. What if Trump adds e.g. a whole country to the sanction list, and tells Microsoft to cut that country off?

replies(1): >>44384992 #
ArcHound ◴[26 Jun 25 07:15 UTC] No.44384992[source]▶
That's the trick behind ROSI. You weight the expected cost without mitigation against the mitigated cost plus the cost of your solution.

The risk of getting cut off is the most random variable on the list. I agree with your point, but I have no data to back it up with.

replies(1): >>44385008 #
lmm ◴[26 Jun 25 07:20 UTC] No.44385008[source]▶
> That's the trick behind ROSI. You weight the expected cost without mitigation against the mitigated cost plus the cost of your solution.

Right but that's clearly not the right way to think about it; if you did that you'd never buy insurance (and probably never do any security work tbh, since very little of it can be justified in expected value terms). The impact of catastrophic damage is nonlinear.

replies(1): >>44385083 #
ArcHound ◴[26 Jun 25 07:32 UTC] No.44385083[source]▶
Yes, at the end of the article I come to the conclusion that this method has flaws. But the general insurance can be modelled with ROSI.

Say you have a 300k USD car. Say that a crash will cost you the full cost. You expect one crash in five years. You then have a yearly expected cost of 60k. If you get an insurance that pays for it all, for 10k USD a year, your ROSI is 500% which sounds like this insurance product is great for you.

replies(2): >>44385101 #>>44385883 #
1. IsTom ◴[26 Jun 25 10:10 UTC] No.44385883[source]▶
That's like saying that you can make profit off credit card debt if rates are negative. It's not a real-world case and nobody is going to offer that, it's not an analysis of any insurance that actually happens.