Slashdot Mirror
Server Snafu Makes Microsoft Beg For CA Audit Data From Its Partners (softpedia.com)
An anonymous reader writes: Microsoft, just like Google, Apple, and Mozilla, is part of the CA/BForum, an organization of web browser vendors and certification authorities (CAs). As a browser vendor, Microsoft maintains a list of authorized CAs and their respective root certificates. According to a message on the CA/BForum, there was an error on the server that was running a CRM application that managed this list of trusted certificates and the adjacent details regarding each certificate and CA. The data is lost forever and Microsoft is now asking CAs to resend their most recent audits. Currently a lot of certs are broken in Edge and IE. Microsoft says that it lost audit data for 147 root certificates, which resulted in many SSL/TLS certificates showing errors inside the company's products.
Seriously. No backup?
I wonder if these are the same people making gui design decisions for windows 10.. I bet the same department head signs both teams' checks.
I'd hate to be in the Retrospective meeting for THAT iteration.
You're supposed to deliver a releasable product, not release all your products (obscure Objective-C reference counting joke).
"There is more worth loving than we have strength to love." - Brian Jay Stanley
can't they just download chrome or firefox and get the equivalent list.
Nullius in verba
If Microsoft can perpetrate something like this, I think I had better set aside some time to verify that I do not have omissions in my own backup and disaster recovery procedures.I cannot imagine having to report something like this to top management.
How many root certificates does Microsoft hold and how long did it take to recover the 147 that were lost? Tech news posted to Slashdot tends to be a little skeletal and runs on the principle of "better late than never."
Microsoft says that it lost audit data for 147 root certificates, which resulted in many SSL/TLS certificates showing errors inside the company's products.
I am curious as well about how often these certificates change. How old a backup is too old?
..Before we find out they were running SSLv2 and got DROWN'ed?
Now, if you'll excuse me, I have backups to corrupt.
"there was an error on the server" "Our CRM system suffered a data loss" way to state the fact that a major company like Microsoft can't even run their own systems correctly. Well where are the fucking backups? Whoopsy-doodle! Looks like Microsoft is about as competent as a 15-man company at backing up critical data.
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
It a load of rubbish from the original author. There's no reason whatsoever that loss of this data would cause problems in IE or Edge. Removing roots from MS's program doesn't happen without human input.
A system crashing and having to restore from an "older" backup is something that could happen to almost anybody.
The one thing that got me in the article:
"As many of you may have just noticed, our system just generated a bunch of emails informing many of you that you are subject to removal because Microsoft does not have evidence of a qualifying audit on file,"
And that they then asked them to re-send the data....
1) If I restore from an older backup, and know I may have (for example) lost payment data, I don't activate batch-jobs that generate demand notes to customers that possibly have already paid, and I just lost the data.
2) Any "important" incoming data, (like for example payment data or SSL Audit data) should be backed once right when it enters the company, so that in the event of your system crashing (or your import-jobs wreaking havoc and losing it) you can re-populate it from that incoming data without having to ask your customers to supply the data again.
So the problem is not really the crashed system, it is the general data flow.
stories such as this make me smirk but also check if my backups are working properly. they are. back to smirking.
but seriously, how often do people normally back up? my /home directory is on a NAS with ZFS and keeps 24 hourly snapshots, 7 daily snapshots, 4 weekly snapshots and 6 monthly ones. this gets automatically synced to my secondary (backup) NAS and once a week i manually sync it to a nas at my parents' house. i lost all my data in the late 90s and never want to go through that experience again.
Redmond appears to be morphing into a comedy of errors in the tech world.
but seriously, how often do people normally back up? my /home directory is on a NAS with ZFS and keeps 24 hourly snapshots, 7 daily snapshots, 4 weekly snapshots and 6 monthly ones. this gets automatically synced to my secondary (backup) NAS and once a week i manually sync it to a nas at my parents' house. i lost all my data in the late 90s and never want to go through that experience again.
Mine is very similar. I can roll back quite a way, and it has come in very helpful.
But the answer to your question is: Most regular people simply don't back up at all. And professional setups aren't always a whole lot better.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Please define the acronyms in the summaries so those of us who aren't experts in a particular topic can follow along.
This should be at a +5. My directors always stopped presenters at dry runs every time they made a Alphabet soup statement. All it takes is giving the letters, then what they stand for, and after that people follow it just fine. And in a multi- skillset place like /., its pretty helpful.
And be careful calling anything an acronym around here, the pedants will jump on you like crocodiles on a wildebeest. Then we'll have 50 posts on what an acronym is or isn't.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
Double click on the word - this will highlight it. Right click on the word and select search, this will open search in a new browser tab. You can even set up a variety of search engines as you go, they'll make it much easier for you.
"So long and thanks for all the fish."
Everybody seems to know what you're talking about, but I've got no idea. Was is spam e-mail or what? (Or was it actually a Bellevue exercise studio? The first page of a Google search didn't list that, and I'd think it would.)
I think we've pushed this "anyone can grow up to be president" thing too far.
Where is the evidence of any SSL/TLS certificates showing errors? Seems like total conjecture based on poor reading of this audit data request made by Microsoft.
This is AUDIT data, not the actual cert info. Read the details of the audit requirements here: http://social.technet.microsoft.com/wiki/contents/articles/31635.microsoft-trusted-root-certificate-program-audit-requirements.aspx
This just means that Microsoft lost the documentation showing that the Certificate Authorities had performed their annual audit. Under normal circumstances, this might mean that those certs would be invalidated but seeing as how this was just a bookkeeping problem on Microsoft's end, they obviously won't invalidate anything.
This is an embarrassment for Microsoft but nothing else.
automated since win10
605413? Yes, it's a prime.
IT'S AN ACRONYM IF YOU PRONOUNCE IT AS A WORD, LIKE NASA
IT'S AN INITIALISM IF YOU READ THE LETTERS, LIKE CIA OR FBI
BLARGARGLARGLARGLARGLARGLARGLARGLARGLARGL!!!!!
Filter error: Don't use so many caps. It's like YELLING. Filter error: Don't use so many caps. It's like YELLING. Filter error: Don't use so many caps. It's like YELLING.
Ya gotta stop after the third espresso!
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.