seafay(tkhsk)

自宅ラックエンジニアとして日々業務にあたりつつ、 自宅ラック勉強会で遊ぶことに大忙し サーバーラックは5架、ブレードサーバーは4基になりました。登録セキスペ #jpemsug 「ひと目でわかる Intune 第3版」 発売中

[seafay(tkhsk) @seafay]

「Microsoft Top Partner Engineer Award」のを3年連続で受賞することができました。 また、来年も継続できるように努力していきます。今年の受賞枠は、Modern Work・Copilot でした。

https://t.co/7dw2zTNlax

https://t.co/yl9zcf16u8

[Jeff Geerling @geerlingguy]

IP KVMs are incredibly handy—and inherently risky. I tested over 20 of them over the past couple years.

One of them even got me an FBI visit ;)

Today's video covers *all* of them: https://t.co/Btq0WqC33c

[碧のレモン @oniadkyoin]

@ogatti21 @GI_nosenseofdir １回限りの講師が人気取って気持ちよくなって満足そうですね😊
その後の責任のない講師は気楽でいいよなぁ

[🌧️ @h4ppyc4ndyd4y]

＼＼ ゆるっとPurview勉強会 ／／

Microsoft Purviewについてゆるっと学ぶ初心者向けの月1勉強会が誕生しました🐣🔰

記念すべき第1回のゲストは @seafay さん！！おにぎり食べながら参加してね🍙

6/27(土) 12:00-13:30
#ゆるPurview #m365jp
#ロゴがおにぎりににてる

https://t.co/zjaEDzFssz

[kokumօtօ @__kokumoto]

I〇Aみたいにいつまで経っても修正未普及理由の開示抑制で、挙句に●●●●●とか言い出して塩漬けを正当化したようなのとか、発見者が優しいうちに甘え過ぎたんすよね。
影響無（確認中）のままN年単位で製品終局まで放置するのが常態化している某士通の悪口ではないです。念のため。

[Ζηνων o Carlos @ZenoEleatis]

Microsoft’s handling of Nightmare Eclipse reveals how little they actually value independent security researchers when it becomes inconvenient.

Nightmare Eclipse followed the proper reporting channels, had his MSRC account revoked, received what amounted to legal threats, published PoCs for several unpatched Windows zero-days, and was subsequently banned from GitHub. Now @msftsecresponse issues a statement claiming they have no intention of pursuing researchers, while continuing to insist that coordinated disclosure is the only acceptable approach. Nightmare Eclipse still has no accounts reinstated and has received no meaningful apology.

Several researchers and observers have been clear about this today. @kln_nurv correctly notes that publishing exploits after attempting responsible disclosure is not a crime, yet there has been neither reinstatement nor apology, only damaged trust. @0x0Fuck rightly demands a public apology from Tom Gallagher (@secbughunter) and full reinstatement of Nightmare Eclipse’s accounts before MSRC can expect any credibility. @Stric_Nine, @PierreGrivet and others have made the same point, this is damage control, not accountability.

I once criticized @elder_plinius for releasing powerful jailbreaks and obliteration tools so openly. I believed it would introduce unnecessary risk and noise into the ecosystem. Under different circumstances, in other times, that view might still apply.

However, Microsoft and other large vendors have deliberately created an environment in which researchers who go public after official channels fail them are punished and silenced. In this reality, Pliny was correct. When companies treat disclosure as a threat to be managed rather than a necessary part of security, radical public release becomes one of the few remaining mechanisms researchers have to maintain visibility and pressure.

This problem is made worse by the rise of agentic attacks that can automatically discover and chain vulnerabilities at scale. The more vendors punish transparency, the greater the advantage they hand to automated exploitation.

Nightmare Eclipse should never have been forced into this position. Given how he was treated, his actions were entirely justified. I stand with the researchers who refuse to accept rules designed primarily to protect vendors.

If @msftsecresponse genuinely valued the security community, Nightmare Eclipse would have his accounts reinstated and there would be a substantive apology. Anything less is simply an attempt to reassert control while avoiding a real responsibility.

[seafay(tkhsk) @seafay]

自分で言ってる話でアレだけど、必要なのは「エンジニア」だけじゃないのがネックなんだろうね

[seafay(tkhsk) @seafay]

Purviewできるエンジニア需要はいかほどか

[こたうち さんさん @kotauchisunsun]

例えば、AI作品の展示会で、「これ面白いｗｗｗ」って言ったり、面白がりはするけど、それを会社のプロトタイプとして持ち込まれたら、
「それってモデルのライセンス商用利用可能なんですか？」
「動かすのにメモリ○○MBのインスタンス必要で月額の固定費が○○円なんですが、1回当たりいくらで提供予定ですか？損益分岐点を何人と勘定してますか？何か月でいくらをサービス撤退基準としますか？」
「1回のAPI使用料に○○円かかりますけど、ご認識されてますか？」
「レスポンスに0.2秒かかると50%の客がページから離脱するっていうデータ有りますけど、どうしますか？この場合だと、離脱率を想定すると○○MAU超えないと、損益分岐超えないですけど、どうしますか？」
という話をしはじめる。
でも、"ビジネスとして"やりたい側に、そこまでの視座と度胸と解像度が無かった場合、エンジニアは"新しいビジネスの種を持ってきたのに、それをつぶす、重箱の隅をつつく、性格の悪いやつ"になる。
で、言われることは
「それを考えるのはエンジニアの仕事だろ。」
って言われる。ってなる。
別に全部無視して作ってもいいんだけど、あとで、
「セキュリティやライセンスはエンジニアが想定してやってくれていることを期待して指示してました」
ってはしごを外されるので、はしごを外させないようにすると、"責任の所在や理解の齟齬をなくそうとするとエンジニアに責任転嫁できなくなる"のでキレられる。

[Microsoft Security Response Center @msftsecresponse]

Over the past several days, we have been listening to the conversation around coordinated disclosure and the relationship between security researchers and vendors. We recognize that this relationship is both critical and, at times, fragile. We deeply value the security community, and will continue to take your feedback seriously.

To be clear about our approach to legal matters, we have no intention to pursue action against individuals conducting or publishing their security research. When an individual breaks the law and engages in malicious activity causing real harm to our customers, we will work with law enforcement as appropriate.

We recognize the work that goes into researching and submitting a vulnerability. We are committed to approaching every interaction with transparency, clear communication, and professionalism. We continue to believe strongly in Coordinated Vulnerability Disclosure as the foundation for protecting customers and improving our products. Each year we process a high volume of vulnerability reports. That volume continues to grow and will continue with the rise of AI-enabled research. We acknowledge that some interactions have fallen short and are working to learn from them.

Many of us have experience on both sides of this work, as researchers reporting vulnerabilities and as responders triaging and assessing them. That perspective informs how we approach this feedback and the importance we place on getting it right, particularly as the volume and complexity of research continues to grow.

The security community plays a vital role in helping us protect customers. We are committed to maintaining a constructive and respectful relationship and growing together. We know that, given the nature of this work, there will at times be misunderstandings. We remain committed to engaging in good faith and to providing a respectful and professional experience for all researchers, regardless of past interactions.

[seafay(tkhsk) @seafay]

@KoiChanTech @oyu3m ガバナンスの文脈をセキュリティで語ると崩壊することが問題なのかしらね

[seafay(tkhsk) @seafay]

Purviewできるエンジニア需要はいかほどか

[おゆ @oyu3m]

ほんとこれ。
Copilotの利用が進めば進むほど起こりうることとして危惧してる。
ただE5がないとシステム的に柔軟にできないので、皆がこれを理解してAI生成データの在り方を考えないといけない。

なお、

[Robert Graham @robertgraham]

We know what probably happened.

From what we see publicly, NightmareEclipse doesn't communicate well, is emotionally immature, and appears to want to extort Microsoft.

Almost certainly, this played a part in the conflict between them and Microsoft -- it's probably as much NightmareEclipse's fault as Microsoft's.

With that said, everything Florian says is correct. It doesn't excuse Microsoft's failures. They are supposed to be the responsible one,

When there is miscommunication or dispute, it's always allowable to drop 0day, regardless whose fault it is. It's Microsoft's job to avoid that, even when they really aren't at fault for the miscommunication.

But Microsoft has convinced themselves of the opposite, that "responsible" disclosure means only the responsibilities of the vuln finder.

Vuln finders have no responsibility. Dropping 0day is responsible. Responsible companies don't have so many bugs.

We let industry subvert the disclosure process. Instead of working to secure their code, vendors have tricked people into believing in the myth of "responsible disclosure", that vendors should be given time to fix and patch their bugs so they are never to blame for the bugs to begin with.

That's why you have customers still buying Fortinet appliances even though their bugs continue to be major sources of customers getting hacked. Customers shrug their shoulders: as long as Fortinet has a vulnerability disclosure program and releases patches, they aren't responsible for when hackers keep breaking into their boxes.

This is garbage. Vendors are still responsible for preventing bugs in the first place, a responsibility that doesn't go away just because they patch.

Regardless of what happened, Microsoft's threats are a gross violation of ethics in the industry.

[seafay(tkhsk) @seafay]

MSがあかんとは思うが
やってることがお互い倫理的にどうなん？って気にもなる

[Abdulkadir | Cybersecurity @cyber_razz]

A researcher found critical Windows zero-days.

Reported them to Microsoft.

Microsoft denied the bug bounty.

Deleted their account.

Banned them from GitHub.

Then threatened criminal charges.

The researcher dropped six zero-days in six weeks.

Three got used in real attacks within days.

Other researchers are now handing them free vulnerabilities as a gift.

Microsoft’s Digital Crimes Unit is considering legal action.

Against the person whose bugs they refused to pay for.

This is Microsoft’s bug bounty program.

[seafay(tkhsk) @seafay]

「マネジメントは嫌いですけど」を他業種の人に薦めて読んでもらってるが
他チームのメンバーにも読んでほしいのだよなぁ

[Guutara (⁰⊖⁰) くぁwせdrftgy ふじこlp @Guutara]

日経の一面に広告なんて、二度とないだろうから、記念に買った。

[seafay(tkhsk) @seafay]

やはり、双子座ジェミニのサガ（カノン）の存在が偉大

[Haruhiko Okumura @h_okumura]

どうでもいいけど、Anthropicは普通に音訳すればアンスロピックだが、どこかの新聞がアンソロピックと書いたのが定着したんだろう（おそらくアンソロジーanthologyと混じった）。Mythos（神話）は英語ではミソスだが、社会学ではギリシア語風にミトスまたはミュトスという。Geminiは英語ではジェミナイだが、星座や有人宇宙飛行計画の名前としてジェミニが定着している

[seafay(tkhsk) @seafay]

本日 12:30 より

[seafay(tkhsk) @seafay]

ほっけさん( @hokke )のお別れ会のお知らせ

[シンジ☁Shinji @sudachikawaii]

ブログ書きましたー
ゼロトラスト導入しました、とか言っちゃう訳のわからん自称ITコンサルや自称セキュリティなんちゃらを呼称する、IT素人連中の顔に擦りつけてやりたい記事です。ゼロトラストは売ってねえんだな。
https://t.co/PQ1hNvKuWM

[seafay(tkhsk) @seafay]

MSRCが盛り上がってる

[夜麻みゆき @miyuki_yama]

『#レヴァリアース』完全版。
「眼差しの先に在る風景」は描き下ろしで、完全版にしか読めません。劣化した夜麻みゆきが読めるよ＼(^o^)／

[谷本 心 (Shin Tanimoto) @cero_t]

勉強会で「え、MySQLをソースコードも読まずに使ってるの？ それだと性能特性が分からなくて怖くない？」と煽られて育った世代です。