Microsoft LinkedIn: Opting and Gigging
February 25, 2021
Microsoft LinkedIn has determined that its millions of job seekers, consultants, and résumé miners can become gig workers. “LinkedIn Is Building a Gig Marketplace” asserts:
LinkedIn is developing a freelance work marketplace that could rival fast-growing gig sites Fiverr and Upwork. The two-sided marketplace will connect freelance service providers with clients in need of temporary workers for one-off projects. Like Fiverr and Upwork, it would focus on knowledge-based work that can be done remotely online…
How long has Microsoft LinkedIn been contemplating this shift? One date offered in the article is 2019. That’s when LinkedIn acquired UpCounsel. The idea is that when one needs a lawyer, one uses a legal version of Match.com. Very me-too. Thomson Reuters offers a service called FindLaw.com, which has been available since the early 2000s. But good ideas take time to gestate. This is not a me too knock off of TikTok which has inspired Facebook and Google innovation. LinkedIn innovated with ProFinder. This is a way for LinkedIn members to find “professionals.”
Sounds good, right?
Writer Joan Westenberg is over LinkedIn, and advises us we would all be better without it. The Next Web posts, “Delete LinkedIn—You’ll Have Zero F****ing Regrets.” After years of enduring countless messages from those who want to sell her something, she finally deleted her LinkedIn account. Not only did the platform fail to provide her any professional benefits, she was also disheartened by the superficial relationships with her hundreds of contacts. (At least this platform does not call them “friends.”)
Having had some success at sales for her business, Westenberg has observed that the way to sell to someone is to build a real relationship with them. Her favorite way to do so is to offer help with no agenda, to demonstrate her products have value. She writes:
“That is the antithesis of LinkedIn. Where people send you off-brand and clumsy sales pitches at best — or at worst, scrape your details for scalable and utterly useless outbound campaigns. They send pitch decks in the same breath that they introduce themselves for the first time. They want you to buy with no reason why. LinkedIn feels less like a platform for selling, and more like a platform for being sold to. A LinkedIn message is the 2020s equivalent of a cold sales call. You dread it. You hate it. You just don’t want to deal with it. … I would rather focus my attention on platforms where I know people have come to genuinely research, interact, learn and consume. Quora. Angel List. Dribble. Medium. Substack. And yes, Twitter. And I would rather remove the false sense of accomplishment we get from engaging on LinkedIn, where we log into a landfill of utter [excrement] several times a day and feel like we’ve done our bit of networking and growing, with no evidence to support that belief.”
Westenberg advises others to join her in ditching the platform. All we will lose, she concludes, are the vanity metrics of clicks, likes, shares, and comments, all of which provide nothing of value. Hmm. I for one have never gotten a job through the platform, but I do know someone who has. Then there are all the professional courses the platform acquired when it snapped up Lynda.com in 2015, many of which are quite helpful. I suppose each user must weigh the site’s role in their professional lives for themselves, but on this point I agree—LinkedIn is not fundamental to professional success.
Cynthia Murrell, February 25, 2021
Microsoft on Security
February 25, 2021
I think that some believe the SolarWinds’ misstep should be called surfing the Microsoft access control process.” I may be wrong on that, of course. I did find some of the statements and quotations in an article called “Microsoft CEO For Global Rules On Data Safety, Privacy.” On the same day that another Microsoftie was explaining the security stumble which has compromised systems at Microsoft itself and a few minor US government agencies, the CEO of the outstanding software company allegedly said:
One thing I hope for is that we don’t fragment, that we are able to, whether it’s on privacy or data safety, bring together a set of global rules that will allow all of us to both comply and make sure that what we build is safe to use.
He allegedly noted:
One of the things we are trying to ensure is how do we have that design principles and engineering processes to ensure that the products and the services are respecting privacy, security, AI ethics as well as the fundamental Internet safety but beyond that there will be regulation.
With some of the source code for Azure, Exchange, and Outlook on the loose, one hopes that those authentication and access control systems are indeed secure. One hopes that the aggressively marketed Windows Defender actually defends. That system appears to have been blind to the surfing maneuvers executed by bad actors for months, maybe a year or more.
Microsoft’s core methods for granting efficient access to trusted users or functions with certifying tokens were compromised. At this time, the scope of the breached systems and the existence if any of sleeper code is not yet quantified.
Assurances are useful in some circumstances. Foundational engineering flaws are slightly more challenging to address.
But “hope” is good. Let’s concentrate security with Microsoft procedures. Sounds good, right? Talk is easier than reengineering perhaps?
Stephen E Arnold, February 25, 2021
Insights into Video Calls
February 24, 2021
I read a ZDNet write up. The word I would use to describe its approach is “breezy.” Maybe “fluffy?” “Microsoft Teams or Zoom? A Salesman Offers His Stunning Verdict” reveals quite a bit about the mental approach of the super duper professionals referenced in the article.
The security of Microsoft Teams and Zoom concern me. The SolarWinds’ misstep resulted in Microsoft’s losing control of some Azure and Outlook software. But we only know what Microsoft elects to reveal. Then there is the Zoom-China connection. That gives me pause.
What’s the write up reveal? Policy or personal preference dictates what system gets clicked. But the write up reveals some other factoids, which I think are quite illuminating.
First, the anonymous sales professional states:
“I’m on video calls eight hours a day. I just do what’s easiest…Some of my meetings are in the middle of the night. You want me to think then?”
Not a particularly crafty person I think. The path of least resistance is the lure for this professional. I like the idea that this professional’s thought processes shut down for the night. To answer the rhetorical question “You want me to think then?”, I would reply, “Yes, you are a professional. If you don’t want to think, go for the Walmart greeter work.” Lazy radiates from this professional’s comment.
Another person explains that answering a question about video conferencing features can be expressed this way:
“Zoom to Teams is like Sephora to Ulta. Or Lululemon to Athleta.”
I assume that this is a brilliant metaphor like one of Shakespeare’s tropes. To me I have zero idea about the four entities offered as points of reference. My hunch is that this individual’s marketing collateral is equally incisive.
A source focused on alcohol research (who knew this was a discipline?) This individual is convinced that Zoom’s “has more security protocols.” This individual does not know that most Zoom bombing is a consequence of individuals invited to a meeting.
Here are my takeaways from the write up:
- The salesman cuts corners
- The person who speaks in terms of product brand names is likely to confuse me when I ask, “What’s the weather?”
- The alcohol researcher’s confidence in Zoom security is at odds with the Zoom bomb thing.
For my Zoom sessions, I use an alias, multiple bonded Internet services, and a specialized VPN. I certainly don’t trust Zoom security. And Microsoft? These pros develop security services which could not detect a multi month breach which resulted in the loss of some source code.
My verdict: Meet in person, wear a mask, and trust but verify.
Stephen E Arnold, February 24, 2021
LinkedIn Phishing
February 22, 2021
One of the news items in an upcoming DarkCyber talks about LinkedIn phishing exploits. I want to mention this method of hijacking or intruding into a system for two reasons. First, Microsoft has been explaining and reframing the SolarWinds’ security misstep for a couple of months. The Redmond giant has used explanations of the breach to market its Windows and Azure security systems. LinkedIn is a Microsoft property, and it seems as if Microsoft would clamp down on phishing attacks after it lost some of the source code to Exchange and a couple of other Microsoft crown jewels. Second, LinkedIn, like Microsoft Teams, is going through a featuritis phase. The service is making publishing, rich media, in message links, and group functions more easily available. The goal is to increase the social network’s value and revenue, particularly among those seeking employment. There’s nothing like a malicious exploit that kills a job hunter’s computing to brighten one’s day.
The article “Phishers Tricking Users via Fake LinkedIn Private Shared Document” explains the exploit. The write up says:
The phishing message is delivered via LinkedIn’s internal messaging system and looks like it has been sent by one of the victim’s contacts. The message urges the recipient to follow a third-party link to view a document.
If you want more details, check out the full Help Net Security post.
In the wake of SolarWinds, I think that Microsoft needs to button up its security. Less marketing and more substantive action seems to be appropriate. Microsoft will be the plumbing for the JEDI program. What vulnerabilities exist within this system? Hopefully none, but recent events and this LinkedIn phishing information suggest reality is insecure.
Stephen E Arnold, February 22, 2021
Microsoft: Technical Excellence Translates to More Excellencerness
February 18, 2021
I found the Microsoft explanation of the SolarWinds’ misstep interesting. CBS circulated some of the information in the interview in “SolarWinds: How Russian Spies Hacked the Justice, State, Treasury, Energy and Commerce Departments.” The point that Windows’ security systems did not detect the spoofing, modifying, and running of Microsoft software was skipped over in my opinion. I loved this statement by Brad Smith, one of the senior executives at the Redmond giant:
When we analyzed everything that we saw at Microsoft, we asked ourselves how many engineers have probably worked on these attacks. And the answer we came to was, well, certainly more than 1,000.
Then failing to detect the breach which seems to have exploited the fascinating Microsoft software update methods:
I think that when you look at the sophistication of this attacker there’s an asymmetric advantage for somebody playing offense.
Okay, “certainly.” Okay, 1,000.
What if SolarWinds’ misstep was not the largest and most sophisticated hack? Is it possible that an insider or a contractor working from home in another country provided the credentials? What if piggybacking on the wild and wonderful Windows’ update system and method was a cottage industry among some bad actors? What if the idea for the malware was a result of carelessness and assumptions about the “security” of how Microsoft and its partners conducted routine business? What if the bad actors used open source software and some commercial reverse engineering tools, information on hacker forums, and trial and error? Does one need a 1,000 engineers? Microsoft may need that many engineers, but in my experience gained in rural Kentucky, a handful of clever individuals could have made the solar fires burn more brightly. Who can manage 1,000 hackers? I am not sure nation states can get 1,000 cyber warriors to a single conference center at one time or get most to read their email, file reports, and coordinate their code. Some may suggest Russia, China, North Korea, or Iran can do these managerial things in a successful way. Not I. The simplest explanation is often the correct one. Insider, opportunism, and a small team makes more sense to me.
Let me shift gears.
What about the spoofing, modifying, and running of Microsoft software for months, maybe a year, maybe more without detecting the intrusion?
I noted “A Vulnerability in Windows Defender Went Unnoticed for 12 Years.” That write up asserts:
A critical bug in Windows Defender went undetected by both attackers and defenders for some 12 years, before finally being patched last fall. The vulnerability in Microsoft’s built-in antivirus software could have allowed hackers to overwrite files or execute malicious code—if the bug had been found. Let’s be clear—12 years is a long time when it comes to the life cycle of a mainstream operating system, and it’s a heck of a long time for such a critical vulnerability to hide.
Sure, let’s be clear. Microsoft talks security. It issues techno-marketing posts like its late January explanation of the SolarWinds’ misstep which I reported on in the DarkCyber video news program on February 9, 2021.
But perhaps more pointed questions should be asked. I don’t want to know about Team featuritis. I don’t want to know why I should not install certain Windows 10 updates or accept updates like the mandatory update KB4023057. I don’t want to know about folding mobile phones. Nope. None of those things.
I want TV interviewers, CBS “real news” writers, and Microsoft to move beyond marketing chatter, hollow assurances, and techno-babble. Oh, I forgot. The election, Covid, and the Azure cloud JEDI thing. I, like others, need their priorities readjusted.
How many employees and partners told Brad Smith, “You were great in the 60 Minutes interview? Lots I would wager.
Stephen E Arnold, February 18, 2021
Microsoft and the Covid: Microsoft 0. The Covid. 1.
February 16, 2021
I believe that everything on Yahoo is true. The write up “Microsoft System Blamed for N.J. Vaccine-Booking Glitches” must be viewed as providing direct insight into the excellence of Microsoft’s engineering. In this week’s DarkCyber, I gave my interpretation of Microsoft’s explanation of the SolarWinds’ affair, and I am delighted to have a different topic about the Redmond behemoth. (I am aware that the odd folding phone has been discounted and that Microsoft thinks Australia’s approach to the Google is the best thing since Windows 3.11.
The New Jersey story is that Microsoft software does not allow the state to schedule Covid injections. I noted:
Five weeks of stumbles by Microsoft Corp. on New Jersey’s Covid-19 vaccine-booking software have left the state pushing for daily fixes on almost every part of the system and doubting it will ever operate as intended…
The write up points out that New Jersey’s love affair with Microsoft was in bloom in May 2021:
“To everyone at Microsoft, who has been a vital partner to our information technology team, New Jersey thanks you,” Murphy [Governor of the great state] said at a May 9 virus briefing in Trenton.
Now the love birds are pecking at one another:
Eight months later, though, on Jan. 6, Persichilli [New Jersey Health Commissioner]called out Microsoft by name in one of the governor’s press briefings. She said “enormous interest in receiving the vaccine” caused “capacity challenges” with the state’s Microsoft-run system.
Some questions crossed my mind:
- Has Microsoft shifted from delivering stable solutions to talking about solutions which require additional work to make licensees bubble with enthusiasm?
- Are the issues with the Covid system similar to those which allowed Windows Defender and its Azure complement to overlook the SolarWinds’ breach for more than a six months, a year, maybe more?
- What are the implications of the Covid system hiccup and the JEDI solution which Microsoft has captured from the Bezos bulldozer and other outfits jockeying for a chunk of the multi-billion dollar US government contract?
If anyone from Microsoft is reading this essay, please, push back using the comments function of the blog. At age 77, I really don’t want to engage with thumbtypers in a text message, email, or phone call joust.
Giblets! Goose feathers! What does New Jersey get for dinner on the Jersey shore sitting fix feet apart and wearing a really nifty MSFT mask?
Stephen E Arnold, February 16, 2021
The SolarWinds Misstep: Who Else Walked Off the Cliff?
February 2, 2021
“Hack Said to Extend Beyond SolarWinds” is a troubling “real” news story. The idea that bad actors may have gained access to commercial and government servers for more than a year was troubling. According to the write up, the data breach has another dimension:
Close to a third of the victims didn’t run the SolarWinds Corp. software initially considered the main avenue of attack for the hackers…
What was the shared point of vulnerability?
The write up dances around the topic, but DarkCyber believes that Microsoft software is the common factor for the breaches, a fact presented at the end of the article:
Mr. Wales [US government cyber security wizard] said his [Cyber Security and Infrastructure] agency isn’t aware of cloud software other than Microsoft’s targeted in the attack.
The Wall Street Journal article reporting a government official’s public statement is located behind a paywall.
Is Microsoft capable of providing cloud and desktop services which are secure. Will a rock band craft a TikTok video based on a remake of the Platters’ hit song the Great Pretender modified to the Great Defender?
Yes I’m the great defender
Just laughin’ and gay like a clown
I seem to be what I’m not, you see
I’m showing my code like a crown
Pretending that JEDI’s still around.
Apologies to Buck Ram.
Stephen E Arnold, February 2, 2021
Microsoft Security: Perhaps Revenue Does Not Correlate with Providing Security?
February 1, 2021
I want to keep this brief. Microsoft makes money from the sale of security services. “Microsoft CEO Satya Nadella: There Is a Big Crisis Right Now for cybersecurity” reports:
For the first time on Tuesday, Microsoft disclosed revenue from its various security offerings as part of its quarterly earnings — $10 billion over the last 12 months. That amounts to a 40% year-over-year jump in the growing security business, making up roughly 7% of the company’s total revenue for the previous year.
Here’s a fascinating passage:
Microsoft itself was also hacked, though no customer data was breached. A Reuters report indicated that, as part of the hack of the National Telecommunications and Information Agency, Microsoft’s Office 365 software was attacked, allowing the intruders to monitor agency emails for months. Microsoft, however, said at the time that it has identified no vulnerabilities in its cloud or Office software.
Er, what?
I don’t want to rain on this financial parade but The Register, a UK online information service, published “Unsecured Azure Blob Exposed 500,000+ Highly confidential Docs from UK Firm’s CRM Customers.” Furthermore, the Microsoft security services did not spot the SolarWinds’ misstep, which appears to have relied upon Microsoft’s much-loved streaming update service. The euphemism of “supply chain” strikes me as a way to short circuit criticism of a series of technologies which are easily exploited by at least one bad actor involved in the more than 12 month undetected breach of core systems at trivial outfits like US government agencies.
Net net: Generating revenue from security does not correlate with delivering securing or engineering core services to prevent breaches. And what about the failure to detect? Nifty, eh?
The February 9, 2021, DarkCyber video program takes a look at another of Microsoft’s remarkable dance steps related to the SolarWinds’ misstep. Do si do, promenade, and roll away to a half sashay! Ouch. Better watch where you put that expensive shoe.
Stephen E Arnold, February 1, 2021
Microsoft: Maybe Quantum Computing Can Help Out Defender?
February 1, 2021
The February 9, DarkCyber video news program contains a short item about Microsoft’s January 20, 2021, explanation of the SolarWinds’ misstep. Spoiler: Hey, Microsoft was not responsible. If you are interested in the MSFT explanation with some remarkable self promotion for its security prowess, navigate to this link. But to the matter at hand. Microsoft security will no doubt benefit from its latest technical innovation. “Microsoft Claims Breakthrough in Quantum Computing” reports:
This [MSFT and University of Sydney] team has developed a cryogenic quantum control platform that uses specialized CMOS circuits to take digital inputs and generate many parallel qubit control signals. The chip that powers this control platform is called Gooseberry.
Does this beg the inclusion of the Intel Horse Feathers — no, strike that — Intel Horse Ridge technology?
The write up continues:
There’s no doubt that both Gooseberry and the cryo-compute core represent big steps forward for quantum computing, and having these concepts peer-reviewed and validated by other scientists is another leap ahead.
I hope the technology innovators surge ahead to apply the “breakthrough” to the Redmond giant’s security for Azure and Windows 10, which of course were not the SolarWinds’ problem. The gilded lily language “supply chain” was maybe, a little, sort of tangentially involved.
Supply chain? Gooseberries and horse feathers perhaps?
Stephen E Arnold, February
High School Science Club Management: The Microsoft GitHub Example
January 18, 2021
Anyone who reads Beyond Search knows that I eschew the old saws of management consulting. No Druckerisms here. I go for more evocative terminology such as HSSCMM or high school science club management methods. The high school science club was the last refuge for those who were not “into” the flow of athletes, elected school representatives, and doing just enough to pass a class in home economics. Nope, the HSSC was THE place for those who knew better than anyone else what was important, knew better how to accomplish a task, and knew better than anyone the wonderfulness of such an esteemed organization.
Thus, a HSSCMM is a rare thing.
I believe I have spotted an example ably described in “GitHub Admits Significant Error of Judgment…” I would point out that GitHub is a Microsoft property and has been since late 2018, sufficient time for the outstanding culture of the Redmond giant to diffuse into the code repository/publishing entity.
The “error” concerns a knee jerk response to a person’s post using a forbidden word. After the employee was terminated, others in the science club management team decided that the dismissal was a misstep. Bigger or smaller than the SolarWinds’ modest toe bump? Who knows.
But, by golly, the Microsoft-GitHub science club alums convened and took a decision: Fire the personnel manager (sometimes called a people manager or a human resources leader).
The management precepts I derive from this fascinating chain of events are:
- Be deciders. Don’t dally. Then without too much hand waving reverse course. The science club precept is that lesser entities will not recall the change of direction.
- Seek scapegoats. Use the Teflon approach so that that which is thrown slides upon the lesser entity, in this case, the amusing people manager function.
- Avoid linking the actions of one part of the science club to the larger science club of which the smaller is merely a decorative ornament; that is, omit the fact that GitHub is owned by Microsoft.
I may have these precepts in a poorly formed state, but I think this GitHub admits article provides a provocative case example. I wonder if Mr. Drucker would agree.
Stephen E Arnold, January 18, 2021
-
- Subscribe to Beyond Search
Feature archive
News archive
-
