←back to thread

Foreign hackers breached a US nuclear weapons plant via SharePoint flaws

(www.csoonline.com)
433 points zdw | 5 comments | 21 Oct 25 15:51 UTC | HN request time: 0.263s | source
Show context
crmd ◴[21 Oct 25 19:41 UTC] No.45660666[source]▶
One of the first things I do after getting an inquiry from a recruiter or friend referral is lookup the MX record for the company’s email domain. It is an anonymous one-command check to see if they’re a Microsoft shop.

If they are, it’s enormous personal red flag. MSFT is very popular so I’m only speaking about my own experience, but I have learned over the course of 20 years that an MSFT IT stack is highly correlated with me hating the engineering culture of an organization.

I know I am excluding a lot of companies with great engineering culture where I would thrive and who just happen to use Outlook/Sharepoint/Teams, etc. but it has had such better predictive power of rotten tech culture than any line of questioning I have come up with during interviews that I still use it.

I don’t mean any disrespect to MSFT-centric engineers out there - it’s not you it’s me.

replies(11): >>45660852 #>>45660872 #>>45661217 #>>45661616 #>>45662254 #>>45662313 #>>45662719 #>>45663474 #>>45663495 #>>45665083 #>>45675213 #
fujigawa ◴[21 Oct 25 20:24 UTC] No.45661217[source]▶
I'm gonna be honest, you sound like a problem employee.

The companies not using Microsoft, are using Google. Which in my experience is equally or measurably worse.

Just personal data points, but every avowed Microsoft hater I've ever worked with has been... difficult. Like a-drag-on-the-team-because-he-refuses-to-use-company-tools difficult.

Edit: How does an aged post on this site go from +4 to -1 in the span of a few minutes?

replies(19): >>45661276 #>>45661318 #>>45661625 #>>45661903 #>>45661968 #>>45662387 #>>45662494 #>>45663148 #>>45663393 #>>45663463 #>>45664329 #>>45664878 #>>45666991 #>>45667600 #>>45667845 #>>45669168 #>>45669404 #>>45671057 #>>45672125 #
bitmasher9 ◴[21 Oct 25 20:33 UTC] No.45661318[source]▶
Doing research on a potential employer and filtering out opportunities based on preferred toolchains is a green flag not a red flag.
replies(3): >>45661558 #>>45661875 #>>45662317 #
Spooky23 ◴[21 Oct 25 20:53 UTC] No.45661558[source]▶
Dev tools, sure. Self-selecting yourself out of the office/email toolset used by 90% of companies seems like a weird flex.
replies(2): >>45661755 #>>45664183 #
philipallstar ◴[21 Oct 25 21:10 UTC] No.45661755[source]▶
Teams is just so much more horrible than Slack and Zoom, and dev teams use Slack and/or Zoom.
replies(5): >>45661871 #>>45664019 #>>45665410 #>>45666207 #>>45666284 #
Spooky23 ◴[21 Oct 25 21:21 UTC] No.45661871[source]▶
Most customers of both use O365.

The zoom fascination is pretty weird. It’s literally Webex 3.0 without Cisco bullshit.

Slack is pretty awesome. It wouldn’t factor in selecting an employer, but that’s just me.

replies(3): >>45662868 #>>45667378 #>>45668054 #
1. zelphirkalt ◴[21 Oct 25 23:03 UTC] No.45662868[source]▶
I definitely wouldn't call Slack "awesome". Self-hosted tools like Zulip are doing a better job. Slack is however, the smaller evil amongst MS Teams, Zoom, MS Outlook and similarly bad software. Like, if someone told me all communication, including text chat shall happen via MS Teams, I would seriously consider looking for another job. It is a recipe for absolute disaster and completely broken communication. If the same happened with Slack, I would dislike it, but I guess it is at least usable. Still garbage, but not as much garbage, as MS Teams.
replies(2): >>45663755 #>>45664734 #
2. 1123581321 ◴[22 Oct 25 03:49 UTC] No.45664734[source]▶
What do you do to make Zulip better than Slack? A vanilla installation is not better, and scales worse with more users, more devices per user more mobile users and more integration sources. But, I’ve never been in a situation where I was forced to make Zulip an attractive communication tool to an organization; there must be a lot that is possible. Getting away from a Salesforce product is a good goal.
replies(2): >>45665482 #>>45668327 #
3. dijit ◴[22 Oct 25 06:22 UTC] No.45665482[source]▶
I’ve never touched a scaling issue with Zulip, how many devices are we talking about here? Maybe I’ve just never touched the walls of scaling it. The architecture seems fine to scale if you self host though.

The only issues I’ve found with Zulip is how it looks and training people to use it right. I’ve had a lot of comments that Zulip has ruined people because they realised how good it is only after they stopped using it, and can tell that everything is so much worse, but the whole time they used it- they hated it.

The other issue, if we can call it as such, is that there’s not that many native third party integrations, we had to write our own bots for some pretty basic things. But writing bots is so much easier in Zulip than Slack (and for Teams its a lesson in genuine masochism) so I give them a pass.

4. zelphirkalt ◴[22 Oct 25 12:53 UTC] No.45668327[source]▶
What I would do if hosting Zulip for a company, is:

(1) host an up to date Zulip version

(2) setup or rent a Jitsi Meet or other open source / free software voice + video chat solution. Jitsi Meet might be a bit difficult to properly set up, compared to Zulip, because of extra things needed, like TURN server and in general the complexities of web RTC. Maybe renting that for some < 10 EUR is fine for a company.

(3) Configure Zulip to have for example `/jitsi` or `/meeting` for creating meetings right out of Zulip.

(4) Setup other integrations, that exist for Zulip.

(5) Setup backups for the Zulip database. It is just a postgres database. One can dump it and move the dump to a backup store.

If this is too much, for example because the company doesn't have the knowledge in their employees to manage this, then one can also rent Zulip hosted solutions.

Getting away from Salesforce alone is in my opinion already worth it.

replies(1): >>45668659 #
5. dijit ◴[22 Oct 25 13:17 UTC] No.45668659{3}[source]▶
Literally did that at my last company, but the google meet link was “meet:<x>” where the friendly URL of the meet-link was inserted.

It worked pretty well, I do wish Zulip had better ability to generate links from the video call button, it works really well with Jitsi this way.