Slashdot Mirror
Server Snafu Makes Microsoft Beg For CA Audit Data From Its Partners (softpedia.com)
An anonymous reader writes: Microsoft, just like Google, Apple, and Mozilla, is part of the CA/BForum, an organization of web browser vendors and certification authorities (CAs). As a browser vendor, Microsoft maintains a list of authorized CAs and their respective root certificates. According to a message on the CA/BForum, there was an error on the server that was running a CRM application that managed this list of trusted certificates and the adjacent details regarding each certificate and CA. The data is lost forever and Microsoft is now asking CAs to resend their most recent audits. Currently a lot of certs are broken in Edge and IE. Microsoft says that it lost audit data for 147 root certificates, which resulted in many SSL/TLS certificates showing errors inside the company's products.
Seriously. No backup?
I wonder if these are the same people making gui design decisions for windows 10.. I bet the same department head signs both teams' checks.
I'd hate to be in the Retrospective meeting for THAT iteration.
You're supposed to deliver a releasable product, not release all your products (obscure Objective-C reference counting joke).
"There is more worth loving than we have strength to love." - Brian Jay Stanley
can't they just download chrome or firefox and get the equivalent list.
Nullius in verba
funniest thing i've read all day
That Excel 2.0 sheet on that dusty beige 486 in the corner got saved over with a blank one, huh?
Now that some new NSA infrastructure is in place they need to re-capture all this audit data.
u don't understand. I don't hate u, just ur childrenz. I'd be great if they died
Currently a lot of certs are broken in Edge and IE.
I didn't see that mentioned in the mailing list, is that just something Softpedia (the author) assumed? If so, I guess it's not that bad ("just" archived audit logs gone missing from their CRM).
Her husband screamed at my girls.
There was a government-granted amnesty before they ordered you do destroy your business and family, so you shouldn't follow your fascist government's demands.
Screaming iz de wayz of her conservative kindz.
And how is this Microsoft's problem? We don't give a fuck about your whore of a daughter.
If Microsoft can perpetrate something like this, I think I had better set aside some time to verify that I do not have omissions in my own backup and disaster recovery procedures.I cannot imagine having to report something like this to top management.
I understand that people reading this site probably know what SSL is. However, it's not a good assumption that people know what CRM means. Please define the acronyms in the summaries so those of us who aren't experts in a particular topic can follow along. The summary does a good job of defining what CA means. But they should give the full version of the acronyms or explain what they are for CRM and SSL/TLS.
Oh, look, it's the "Republicans hate us and want us to die" jackass, now posting the same stupid shit about Melinda Gates. It's precisely the same posting style, unmistakable by its single line of fucking inane, barely coherent, poorly spelled comments pretending to have a discussion with itself about how someone (e.g., Republicans, Melinda Gates, Facebook) supposedly wants them to die. Please ban this poster, who has crapflooded many articles with this bullshit over the past several weeks.
And to the AC posting this shit, I echo another AC who told you this is irrelevant and that nobody gives a fuck about your whore of a daughter. Fuck off.
How many root certificates does Microsoft hold and how long did it take to recover the 147 that were lost? Tech news posted to Slashdot tends to be a little skeletal and runs on the principle of "better late than never."
Microsoft says that it lost audit data for 147 root certificates, which resulted in many SSL/TLS certificates showing errors inside the company's products.
I am curious as well about how often these certificates change. How old a backup is too old?
Also SPOF for everyone dependent on this particular CA certificate store.
and settle it once and for all. Unless it is a tie. One member short, after all.
That's what she said. Literally.
..Before we find out they were running SSLv2 and got DROWN'ed?
Now, if you'll excuse me, I have backups to corrupt.
"there was an error on the server" "Our CRM system suffered a data loss" way to state the fact that a major company like Microsoft can't even run their own systems correctly. Well where are the fucking backups? Whoopsy-doodle! Looks like Microsoft is about as competent as a 15-man company at backing up critical data.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
...all Microsoft customers have to tell Microsoft what licenses they have ?
It was her, and not her husband, that got asked to leave LA Fitness in Bellevue this week.
A system crashing and having to restore from an "older" backup is something that could happen to almost anybody.
The one thing that got me in the article:
"As many of you may have just noticed, our system just generated a bunch of emails informing many of you that you are subject to removal because Microsoft does not have evidence of a qualifying audit on file,"
And that they then asked them to re-send the data....
1) If I restore from an older backup, and know I may have (for example) lost payment data, I don't activate batch-jobs that generate demand notes to customers that possibly have already paid, and I just lost the data.
2) Any "important" incoming data, (like for example payment data or SSL Audit data) should be backed once right when it enters the company, so that in the event of your system crashing (or your import-jobs wreaking havoc and losing it) you can re-populate it from that incoming data without having to ask your customers to supply the data again.
So the problem is not really the crashed system, it is the general data flow.
They should stop using Microsoft software. I know, they're Microsoft, but that means they should know best to avoid it :)
"Currently a lot of certs are broken in Edge and IE. Microsoft says that it lost audit data for 147 root certificates, which resulted in many SSL/TLS certificates showing errors inside the company's products."
WTF does this mean? Did they push an incomplete CA list as an update? And Chrome uses the system root CA database, is that broken too?
Redmond appears to be morphing into a comedy of errors in the tech world.
You trust them that they're not really spying on you with windows 10.
You have to grant it to Microsoft - they do know how to look stupid and ridiculous.
Everybody seems to know what you're talking about, but I've got no idea. Was is spam e-mail or what? (Or was it actually a Bellevue exercise studio? The first page of a Google search didn't list that, and I'd think it would.)
I think we've pushed this "anyone can grow up to be president" thing too far.
Where is the evidence of any SSL/TLS certificates showing errors? Seems like total conjecture based on poor reading of this audit data request made by Microsoft.
This is AUDIT data, not the actual cert info. Read the details of the audit requirements here: http://social.technet.microsoft.com/wiki/contents/articles/31635.microsoft-trusted-root-certificate-program-audit-requirements.aspx
This just means that Microsoft lost the documentation showing that the Certificate Authorities had performed their annual audit. Under normal circumstances, this might mean that those certs would be invalidated but seeing as how this was just a bookkeeping problem on Microsoft's end, they obviously won't invalidate anything.
This is an embarrassment for Microsoft but nothing else.