Most active commenters
  • necovek(4)
  • stackskipton(4)

←back to thread

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

(www.csoonline.com)
433 points zdw | 21 comments | 21 Oct 25 15:51 UTC | HN request time: 0.001s | source | bottom
Show context
stackskipton ◴[21 Oct 25 19:17 UTC] No.45660335[source]▶
As usual with all these types of posts, people go "HA HA, MICRO$OFT SUCKS" without understanding business practices that keep them afloat.

Don't use Exchange? Cool, what should we use instead? Does it support 15 people all the way up to 150000 people? I used to run Exchange cluster for 70k people, is there other mail software out there complete with non-shared disk redundancy? Where the users connect to single endpoint and software figures it out from there?

Sharepoint with another 2 RCEs. Not shocked, the software is terrible. However, it's only software that will stand up under load and let us shard it easily. All open-source software is one of those, runs fine in Homelab, likely falls down under load. Few Open Source Developers want to work on this stuff which I get because it's tedious work interfacing with computer illiterate end users. I'd rather chug sewage then do this work for free.

Finally, it's somewhat backwards compatible. Most businesses are filled with ancient software that no one has worked on in 20 years. That Excel document with Macros from 1997. With some registry changes degrading security posture, still works. I doubt you will find Office software with level of backwards compatibility unless they are using Microsoft Office level of compatibility.

Microsoft has real gordian knot here and few solutions besides "Backwards compatibility is OVER. Upgrade to modern or GTFO". Meanwhile, I get hit up by $ThreeJobsAgo over some Exchange Web Services solution I slapped together for them in Python they wanted me to upgrade to GraphAPI since Microsoft turned off Exchange Web Services in Office365.

replies(13): >>45660418 #>>45660587 #>>45660597 #>>45660667 #>>45660671 #>>45660681 #>>45660723 #>>45660777 #>>45660784 #>>45661246 #>>45663047 #>>45663124 #>>45665208 #
1. necovek ◴[21 Oct 25 19:41 UTC] No.45660667[source]▶
I see you build a case for traditional MS product in Exchange, yet this issue is about Sharepoint.

Just like with Windows, Microsoft has built a moat with Exchange, but the question is why do all the companies buy into their full ecosystem, especially for anything relating to web technologies (you even bring up Exchange Web Services), because this they do really badly, and Sharepoint seems to be the worst.

However, I am certain there are big Postfix/Dovecot installations scaling easily to 150k people, but we probably wouldn't know about them. Eg. here a couple of accounts of people doing that: https://www.reddit.com/r/linuxadmin/comments/32fq67/how_woul...

replies(6): >>45660796 #>>45660845 #>>45660876 #>>45660981 #>>45663661 #>>45665175 #
2. elevation ◴[21 Oct 25 19:50 UTC] No.45660796[source]▶
Not sure the total number, but a university near me serves 50K active students and hundreds of thousands of alums with Postfix/Dovecot.
3. inopinatus ◴[21 Oct 25 19:53 UTC] No.45660845[source]▶
I was running millions of accounts using Postfix/Dovecot on shared-nothing storage with a single MUA-facing endpoint and complex policy options, and that was over a decade ago.

Fastmail today would be much bigger again, and they’re on CMU Cyrus.

150k is rookie numbers. Perhaps that was meant ironically to satirise mediocre enterprise thinking?

replies(3): >>45660911 #>>45661642 #>>45663234 #
4. stackskipton ◴[21 Oct 25 19:55 UTC] No.45660876[source]▶
I used Exchange because it was what I most familiar with. SharePoint operates in similar matter with all sharding (though backend is still MSSQL with it's sharding last I checked)

Sure, PostFix/DoveCot will scale if you are doing just email. Once you add GroupWare requirements, PostFix/Dovecot are no longer in same boat.

replies(1): >>45666835 #
5. stackskipton ◴[21 Oct 25 19:57 UTC] No.45660911[source]▶
Cool, you got a blog article detailing how that works with Postfix/Dovecot? All clustering articles I'm seeing for those involved shared storage. Fastmail is not very specific how that works.

In any case, Exchange is not just email, it has Calendaring/Contacts stuff going on as well.

replies(1): >>45660934 #
6. ◴[21 Oct 25 20:00 UTC] No.45660934{3}[source]▶
7. MisterTea ◴[21 Oct 25 20:04 UTC] No.45660981[source]▶
> but the question is why do all the companies buy into their full ecosystem,

Old manager I had one told me: "I wish Microsoft made all the software in the world because it works so well together!" He was the guy who bought our company a one-way ticket to O365. He was also woefully tech ignorant and could barley drive software outside of office programs.

replies(1): >>45663255 #
8. Spooky23 ◴[21 Oct 25 21:00 UTC] No.45661642[source]▶
Cool. I did that with qmail in 1998 on a couple of Ultra 5s.

Try managing a calendar or booking resources.

replies(2): >>45662023 #>>45662132 #
9. ◴[21 Oct 25 21:35 UTC] No.45662023{3}[source]▶
10. inopinatus ◴[21 Oct 25 21:46 UTC] No.45662132{3}[source]▶
Integrated CalDAV is also available. Not in qmail, however. The patch for that would be large.
replies(1): >>45681737 #
11. xxs ◴[21 Oct 25 23:47 UTC] No.45663234[source]▶
>Perhaps that was meant ironically to satirise mediocre enterprise thinking?

It's a serious post, unfortunately.

replies(1): >>45663725 #
12. casey2 ◴[21 Oct 25 23:50 UTC] No.45663255[source]▶
Yup, proves the old adage that you never let the tech fluent make tooling decisions for normal people. Nothing would kill a large orgs momentum faster than half their employees stuck reading man pages for trivial tasks. Microsoft is a good black and white, you can do this or you can't. Which works better organizationally than the "I bet I could hack this together in a few weeks" and have everyone wait around so one "10x dev" can feel like a special snowflake
replies(1): >>45671940 #
13. zenmac ◴[22 Oct 25 00:43 UTC] No.45663661[source]▶
Craigslist has also uses Haraka to scale their email.

https://haraka.github.io

There are plenty of open source email alternatives now days.

14. stackskipton ◴[22 Oct 25 00:52 UTC] No.45663725{3}[source]▶
Yep, my point was “What is the alternative besides other enterprise cloud like GSuite and others?”
replies(1): >>45665303 #
15. lkjdsklf ◴[22 Oct 25 05:25 UTC] No.45665175[source]▶
Comparing postfix/dovecot to exchange is grossly misunderstanding what’s happening

If you’re using exchange/outlook, you’re using Active Directory.

The only real “altetnative” is the reimplementation in samba v4.. calling that an alternative is a bit of a stretch. And it barely scales to one user let alone millions like AD can

replies(1): >>45665262 #
16. necovek ◴[22 Oct 25 05:42 UTC] No.45665262[source]▶
You can trivially set up Postfix/Dovecot with LDAP.
replies(1): >>45668554 #
17. necovek ◴[22 Oct 25 05:48 UTC] No.45665303{4}[source]▶
FWIW, GSuite seems to do fewer things, but at least does them better (think nested groups and calendar invitations for parent groups: adding/removing people does not update future events with MS tools).

But at the same time, within an org of 150k people, we have separate people to support our Teams usge, our Outlook usage, our AD/Entra usage: with the same number of "sysadmins", could we do the same with open source stack?

I don't know, but I know the bugs I see with MS365.

18. p_ing ◴[22 Oct 25 09:51 UTC] No.45666835[source]▶
SharePoint does not use [SQL] sharding. Each Site Collection is contained within a single Content [SQL] database. However the blobs themselves can be stored elsewhere via a provider, out of the box a file system provider is available (in SPO they use Azure Blob Storage).
19. lkjdsklf ◴[22 Oct 25 13:09 UTC] No.45668554{3}[source]▶
There’s nothing trivial about running or scaling an ldap server.

Ldap is also not Active Directory. Ldap is one very small part of it

20. necovek ◴[22 Oct 25 16:54 UTC] No.45671940{3}[source]▶
You are ignoring the fact that people are mostly complaining about Microsoft saying their software will do something, and then it not really working or falling apart (like with security incidents).
21. Woodi ◴[23 Oct 25 13:43 UTC] No.45681737{4}[source]▶
Why DAV should be integrated into any SMTPd ?? DAV is some protocol over HTTP - another service, another port. Why any architect want it in same binary or even deployed on same server ?? And even if some "cal" or "address" part is content in email that still processing it is totally different software layer then plain "sending mail" and storing it.

But no, people get self backdoored by using Exchange... Or clolud :) Or AI hosted by someone else...