A Microsoft team racing to catch bugs before they happen(wired.com)
wired.com
A Microsoft team racing to catch bugs before they happen
https://www.wired.com/story/microsoft-morse-team/
63 comments
[deleted]
aliqot(4)
Great job here.
But what about the rest of the platform? It's knee deep in layers of crap accumulated over 20 years due to schizophrenic product management. Nothing is finished. Everything is broken or limping or painful to use. Every major release just adds another layer of crud.
I want to come back to the platform but it hurts me. Every bloody day I have to use anything Microsoft it is literally a productivity draining nightmare.
But what about the rest of the platform? It's knee deep in layers of crap accumulated over 20 years due to schizophrenic product management. Nothing is finished. Everything is broken or limping or painful to use. Every major release just adds another layer of crud.
I want to come back to the platform but it hurts me. Every bloody day I have to use anything Microsoft it is literally a productivity draining nightmare.
I personally feel like Windows in the past 3-4 years has been slowly unifying to at the very least be more consistent. Part of this was the introduction of Windows Terminal, the rebuild of Notepad, tweaks to Explorer, rebuild of Task Manager coming in 22H2, and the huge overhaul to Settings which is slowly rendering Control Panel obsolete.
That they have released any version of windows without 100% consistency is itself an abomination. We’re not even talking about a nit, there are literally completely different paradigms within Settings itself as you click around, and that’s just one example of many. Perhaps it’s my Apple-bias, but every time I go to use Windows I just go “wow how could they say yup ship it?!”
extreme backwards compatability is my guess. There is probably some ancient program a business is running somewhere out there which depends on the control panel, or that random button, being there for whatever reason.
"the huge overhaul to Settings which is slowly rendering Control Panel obsolete."
I bet we'll have nuclear fusion before the Control Panel is obsolete.
I bet we'll have nuclear fusion before the Control Panel is obsolete.
These things are pretty much just bike shedding though in the scale of the problems with Windows.
They are very easy to market as improvements though and MSFT is entirely driven by marketing now rather than quality and engineering.
They are very easy to market as improvements though and MSFT is entirely driven by marketing now rather than quality and engineering.
notepad could be built by a smart 12 year old over a weekend
and a terminal is a pretty common single person open source project
meanwhile the shell has something like 7 different styles of context menu, with several new ones added with every major release
and a terminal is a pretty common single person open source project
meanwhile the shell has something like 7 different styles of context menu, with several new ones added with every major release
Notepad uses bare Win32 API calls. If a 12 year old can handle that in a weekend, I'm Rihanna.
I taught myself coding Win32 API in C as a young teenager, nothing magic about it. And Notepad is a very basic app.
[deleted]
it's an edit control inside a window
take the standard example of how to create a window and add one more CreateWindow() call
take the standard example of how to create a window and add one more CreateWindow() call
Ah, simple like this: https://github.com/genuinelucifer/mypad
I like that part:
I like that part:
hEdit = CreateWindowEx (
WS_EX_CLIENTEDGE, /* Extended possibilites for variation */
"EDIT", /* Classname */
"", /* Title Text */
WS_CHILD|WS_VISIBLE|WS_VSCROLL|WS_HSCROLL|ES_MULTILINE|ES_AUTOHSCROLL|ES_AUTOVSCROLL , /* default window */
1, /* Windows decides the position */
1, /* where the window ends up on the screen */
100, /* The programs width */
100, /* and height in pixels */
hwnd, /* The window is a child-window to hwnd */
(HMENU) IDC_EDIT, /* No menu */
GetModuleHandle(NULL), /* Program Instance handler */
NULL /* No Window Creation data */
);yes?
notepad's entire front end is an edit control slapped onto the barebones minimal Win32 example
they wouldn't need to understand all of it, only to make small additions based on modifying what's already there:
admittedly kids these days aren't going to be interested in programming for a dead API (Win32)
notepad's entire front end is an edit control slapped onto the barebones minimal Win32 example
they wouldn't need to understand all of it, only to make small additions based on modifying what's already there:
- adding the edit control (as discussed)
- add Open/Save items to the existing example menu
- a few lines in the event loop to implement that functionality
admittedly kids these days aren't going to be interested in programming for a dead API (Win32)
[deleted]
LeonTheremin(1)
"Isn't that what QA is for?"
In a sense, finding security bugs is a very specialized QA sub-discipline, which often requires a far deeper understanding about security than many QA engineers or developers possess. However, there is also a part of that organization which does feature work to systemically address the kinds of security issues they find.
Also, many large organizations like MS don't have many QA teams, preferring to push QA tasks onto developers, but still need specialized security teams. If you dig into the deep history of morse, they barely escaped being sacked when MS laid off the QA org circa 2017.
(I used to work on that team, but now work at another company doing a similar job)
Also, many large organizations like MS don't have many QA teams, preferring to push QA tasks onto developers, but still need specialized security teams. If you dig into the deep history of morse, they barely escaped being sacked when MS laid off the QA org circa 2017.
(I used to work on that team, but now work at another company doing a similar job)
Agreed - none of the QAs I have ever worked with have done security testing (unless called out in the test plan). One of the companies I have worked for does annual penetration tests which seems reasonable.
You mean, the job description they ended in 2006? Sure
> At Microsoft, we have everything from silicon to compilers to the operating system
In what way does Microsoft "have silicon"? They don't own a fab, FAFAIK. Do they design their own processors like Amazon does, or is this simply referring to the amount of datacenters Microsoft is operating for their Azure platform?
In what way does Microsoft "have silicon"? They don't own a fab, FAFAIK. Do they design their own processors like Amazon does, or is this simply referring to the amount of datacenters Microsoft is operating for their Azure platform?
I believe the Hololens is custom silicon
https://www.anandtech.com/show/14775/hot-chips-31-live-blogs...
https://www.anandtech.com/show/14775/hot-chips-31-live-blogs...
They have custom FPGAs in Azure to offload networking and storage from the host CPU. There's an internal team designing and deploying all these, and the eventual goal is to have all this on ASICs for even more efficiency. Though you are right that they'll be subcontracting out the actual fabrication.
Gotta be thinking they’re working on their own graviton given how much aws claims it’s saving them.
Xbox and Pluton, at least.
Both are specs though. AMD does the design according to Microsoft's requirements but you can't really call that silicon design on behalf of Microsoft.
Also, technically the SQ* chips (like SQ1 used in Surface X) are also Microsoft chips, though they look more like slightly tweaked / rebranded Qualcomm devices.
Does Microsoft pay for this kind of story, or is more one of those quid pro quo kind of things? As a real interview with the security team would be somewhat interesting, but this empty praise reads more like a press release then any kind of article
This kind of piece usually happens because of the following common industry practice:
A company's PR department (usually via an outside publicist) approaches a friendly (or likely friendly) journalist with an idea for the story. They promise special access to company information and lots of quotes for the story. Serious outlets won't let the company "help" with the drafting, but sometimes the company will provide proposed language for all or some of the story.
It's a good arrangement for the company and journalist. The company controls the narrative and plants stories that fit its current PR goals.
The journalist gets an easy piece--more or less pre-packaged and with minimal need to do their own investigation. Journalists have an incentive not to pose difficult questions or push back too hard: Those who do get a "bad" reputation with publicists, leaving them out of the running for future pre-packaged stories.
There are lots of variations on the above. Some aren't nefarious and the result is still good journalism.
And sometimes the result is a transparent puff piece.
A company's PR department (usually via an outside publicist) approaches a friendly (or likely friendly) journalist with an idea for the story. They promise special access to company information and lots of quotes for the story. Serious outlets won't let the company "help" with the drafting, but sometimes the company will provide proposed language for all or some of the story.
It's a good arrangement for the company and journalist. The company controls the narrative and plants stories that fit its current PR goals.
The journalist gets an easy piece--more or less pre-packaged and with minimal need to do their own investigation. Journalists have an incentive not to pose difficult questions or push back too hard: Those who do get a "bad" reputation with publicists, leaving them out of the running for future pre-packaged stories.
There are lots of variations on the above. Some aren't nefarious and the result is still good journalism.
And sometimes the result is a transparent puff piece.
do you ask that kind of question of other companies who get articles about them in magazines?
I suspect that you don't, and I also suspect that you do not see the problem with that. I apologize if I am wrong.
I suspect that people just like to complain about Microsoft. any opportunity to shart on them will be gleefully taken, and carefully camouflaged to look more insightful, and less like the disdain that it actually is.
it's popular to crap on Microsoft today because over 20 years ago they bundled a browser and complained openly about Linux.
no one shits on Google or Facebook at every opportunity, because bending the entire earth and all of its economies to get people to click on advertisements isn't viewed as the absolutely disasterous activity it truly is. no one shits on Amazon because they make people sign in and out of the bathroom, actively crush organization efforts (which is blatantly illegal) or make people piss in bottles.
all that stuff gets a pass here BECAUSE YOU FOOLS WORK AT THOSE PLACES and "my team doesn't do any of that".
complain about fluff pieces for every company or complain about none. "there ain't no third direction."
I suspect that you don't, and I also suspect that you do not see the problem with that. I apologize if I am wrong.
I suspect that people just like to complain about Microsoft. any opportunity to shart on them will be gleefully taken, and carefully camouflaged to look more insightful, and less like the disdain that it actually is.
it's popular to crap on Microsoft today because over 20 years ago they bundled a browser and complained openly about Linux.
no one shits on Google or Facebook at every opportunity, because bending the entire earth and all of its economies to get people to click on advertisements isn't viewed as the absolutely disasterous activity it truly is. no one shits on Amazon because they make people sign in and out of the bathroom, actively crush organization efforts (which is blatantly illegal) or make people piss in bottles.
all that stuff gets a pass here BECAUSE YOU FOOLS WORK AT THOSE PLACES and "my team doesn't do any of that".
complain about fluff pieces for every company or complain about none. "there ain't no third direction."
>do you ask that kind of question of other companies who get articles about them in magazines?
Yes. Not audibly every time, but this article was particularly shallow, containing nothing but praise even though their security history is hardly immaculate.
By comparison, the last article about Amazon I read here was about their leaked document on trying to crush unions. The last about Google was either them shutting down some other product I've never heard of or a complaint about how their search is now worse.
Yes. Not audibly every time, but this article was particularly shallow, containing nothing but praise even though their security history is hardly immaculate.
By comparison, the last article about Amazon I read here was about their leaked document on trying to crush unions. The last about Google was either them shutting down some other product I've never heard of or a complaint about how their search is now worse.
> no one shits on Google or Facebook at every opportunity
They don't? I feel like I see ten times as much shitting on Google and Facebook these days, on HN, compared to Microsoft.
They don't? I feel like I see ten times as much shitting on Google and Facebook these days, on HN, compared to Microsoft.
look again. people come out of the woodwork to crap on Microsoft. you'll see SOME of that for FB or Google, and nowhere nearly as much. people are ANGRY at Microsoft, and they merely recognize that Google and FB and Amazon are problems without anger or any real call to action about it.
it's very weird. things Microsoft did over 20 years ago anger people a lot more than things happening today, and I don't understand why at all.
it's very weird. things Microsoft did over 20 years ago anger people a lot more than things happening today, and I don't understand why at all.
I'm inclined to believe this is an unpaid story by a naively passionate technologist.
Parents name their kids after Apple products. Reason dictates some of them would be passionate enough to write about it, and if it gets clicks it'll end up on one outlet or another - this time its Wired.
I do believe people pay for stories and awards and all kinds of stuff to hype their brand, startups in particular.
Parents name their kids after Apple products. Reason dictates some of them would be passionate enough to write about it, and if it gets clicks it'll end up on one outlet or another - this time its Wired.
I do believe people pay for stories and awards and all kinds of stuff to hype their brand, startups in particular.
I also think it's unpaid, because the consequences are too significant if it's leaked that there was collusion for Wired to publish a puff piece in exchange for money from Microsoft, and Wired didn't mark it as "sponsored content" or similar.
It's bad for the writer because it shows the writer can be bought, reducing the credibility of previous and future work (though this does happen). It's also bad for Wired as it will be seen as biased for future reports on Microsoft. And it's bad for Microsoft because unpaid positive articles are worth more than positive articles that are suspected to be paid for.
At the most cynical, it's possible the writer wrote this in exchange for building relationships with the sources for future interviews and getting scoops (payment in a different way). More optimistically, the writer was naively passionate as you rote. Still, in any case, the writer could've asked at least some hardball or technically interesting questions for the report.
It's bad for the writer because it shows the writer can be bought, reducing the credibility of previous and future work (though this does happen). It's also bad for Wired as it will be seen as biased for future reports on Microsoft. And it's bad for Microsoft because unpaid positive articles are worth more than positive articles that are suspected to be paid for.
At the most cynical, it's possible the writer wrote this in exchange for building relationships with the sources for future interviews and getting scoops (payment in a different way). More optimistically, the writer was naively passionate as you rote. Still, in any case, the writer could've asked at least some hardball or technically interesting questions for the report.
The fact that it reads as paid, means that Wired leadership failed.
> Does Microsoft pay for this kind of story
I think we all do.
FWIW, Microsoft security was talking about the same thing 20 years ago but they were under DOJ scrutiny and couldn't get positive press from then-hip Wired. So I guess positive spin that reads like Microsoft wrote it is new . . .
https://www.wired.com/2002/11/u-s-v-microsoft-timeline/
I think we all do.
FWIW, Microsoft security was talking about the same thing 20 years ago but they were under DOJ scrutiny and couldn't get positive press from then-hip Wired. So I guess positive spin that reads like Microsoft wrote it is new . . .
https://www.wired.com/2002/11/u-s-v-microsoft-timeline/
Haha, as if Microsoft cares whether bugs happen!
Any that do and affect Microsoft profits can be fixed later. Most never end up obviously affecting Microsoft profits, however badly they might harm somebody else. Some of those might get fixed eventually, if a reason ever turns up. More commonly, whatever they are in gets retired or anyway superseded first.
It is a waste of profits to spend time fixing what might not end up needing to be.
Any that do and affect Microsoft profits can be fixed later. Most never end up obviously affecting Microsoft profits, however badly they might harm somebody else. Some of those might get fixed eventually, if a reason ever turns up. More commonly, whatever they are in gets retired or anyway superseded first.
It is a waste of profits to spend time fixing what might not end up needing to be.
Every time Microsoft issues a patch for Windows, there're bugs.
Not necessarily. For example, the official name of Turkey recently changed to Türkiye. That may require issuing a patch, but I wouldn’t call having outdated information a bug. The same may happen with the time zone database.
Of course, they may have a different mechanism for keeping such lists up to date, but even then, they can be caught by surprise. Let’s say some country decides to move to X hours and 5 minutes relative to GMT, while the built-in mechanism assumes that’s done in 15 minute intervals.
Of course, they may have a different mechanism for keeping such lists up to date, but even then, they can be caught by surprise. Let’s say some country decides to move to X hours and 5 minutes relative to GMT, while the built-in mechanism assumes that’s done in 15 minute intervals.
Is there a Microsoft team "racing to catch bugs after they happen" ? Because there are a lot of ugly bugs not fixed for years.