The blog post "The 'S' in MCP Stands for Security" details a security vulnerability discovered by the author in Microsoft's Cloud Partner Portal (MCP). The author found they could manipulate partner IDs in URLs to access sensitive information belonging to other partners, including financial data, customer lists, and internal documents. This vulnerability stemmed from the MCP lacking proper authorization checks after initial authentication, allowing users to view data they shouldn't have access to. The author reported the vulnerability to Microsoft, who acknowledged and subsequently patched the issue, emphasizing the importance of rigorous security testing even in seemingly secure enterprise platforms.
The IEEE offers a credentialing program designed to recognize and enhance professional development in various technical fields. These credentials, including certifications and certificates, validate expertise in areas like software development, systems engineering, and cybersecurity. The program aims to help individuals advance their careers by demonstrating competency, staying current with industry trends, and gaining a competitive edge. IEEE credentials are built upon rigorous standards, peer review, and continuing education requirements, ensuring quality and relevance in a rapidly evolving technological landscape. They offer individuals a way to showcase specialized knowledge and skills to potential employers and clients.
Hacker News users discussing the IEEE credentialing program express skepticism and concern about its value. Several commenters question whether the program offers any real benefits, particularly given its cost. Some suggest it might be more beneficial for engineers to focus on building a strong portfolio and gaining practical experience rather than pursuing this credential. The lack of employer recognition and the seemingly generic nature of the offered credentials are recurring criticisms. A few commenters mention the potential for the program to be useful in specific niche areas or for individuals earlier in their careers, but the overall sentiment leans towards viewing it as unnecessary and potentially even harmful to the IEEE's reputation.
A new "Calm Technology" certification aims to highlight digital products and services designed to be less intrusive and demanding of users' attention. Developed by Amber Case, the creator of the concept, the certification evaluates products based on criteria like peripheral awareness, respect for user attention, and providing a sense of calm. Companies can apply for certification, hoping to attract users increasingly concerned with digital overload and the negative impacts of constant notifications and distractions. The goal is to encourage a more mindful approach to technology design, promoting products that integrate seamlessly into life rather than dominating it.
HN users discuss the difficulty of defining "calm technology," questioning the practicality and subjectivity of a proposed certification. Some argue that distraction is often a function of the user's intent and self-control, not solely the technology itself. Others express skepticism about the certification process, wondering how "calmness" can be objectively measured and enforced, particularly given the potential for manipulation by manufacturers. The possibility of a "calm technology" standard being co-opted by marketing is also raised. A few commenters appreciate the concept but worry about its implementation. The overall sentiment leans toward cautious skepticism, with many believing the focus should be on individual digital wellness practices rather than relying on a potentially flawed certification system.
Summary of Comments ( 36 )
https://news.ycombinator.com/item?id=43600192
Hacker News users generally agree with the author's premise that the Microsoft Certified Professional (MCP) certifications don't adequately address security. Several commenters share anecdotes about easily passing MCP exams without real-world security knowledge. Some suggest the certifications focus more on product features than practical skills, including security best practices. One commenter points out the irony of Microsoft emphasizing security in their products while their certifications seemingly lag behind. Others highlight the need for more practical, hands-on security training and certifications, suggesting alternative certifications like Offensive Security Certified Professional (OSCP) as more valuable for demonstrating security competency. A few users mention that while MCP might not be security-focused, other Microsoft certifications like Azure Security Engineer Associate directly address security.
The Hacker News post "The "S" in MCP Stands for Security," linking to an article about security issues related to Microsoft Certified Professional certifications, has generated a moderate discussion with several insightful comments.
Several commenters discuss the broader implications of certification programs. One commenter points out that certifications often focus on memorization rather than practical skills, arguing that this approach doesn't necessarily translate to real-world competence, especially in a field like security. They highlight the difference between knowing the definition of a security concept and being able to apply it effectively in a complex situation. This comment resonates with others who share similar skepticism about the value of certifications as a sole indicator of expertise.
Another thread discusses the specific vulnerabilities mentioned in the linked article, with some users expressing concern about the potential impact of these security flaws. One commenter questions the rigor of the certification process if such vulnerabilities exist, suggesting a need for more robust testing and validation.
Others delve into the ethical considerations of disclosing security vulnerabilities in certification exams. One commenter raises the dilemma of responsible disclosure, questioning the appropriate channels for reporting such issues and the potential repercussions for individuals who discover them. This sparks a brief discussion about the balance between public disclosure and responsible reporting to the relevant authorities.
Finally, a few commenters offer alternative perspectives on the value of certifications. One suggests that certifications can be a useful starting point for individuals entering the field, providing a structured learning path and a basic level of knowledge. Another argues that while certifications may not be a perfect measure of expertise, they can still serve as a valuable signaling mechanism for employers, helping them identify candidates with a certain level of foundational knowledge.
Overall, the comments reflect a nuanced perspective on the role and value of certifications in the security field, acknowledging both their limitations and potential benefits. The discussion highlights the importance of practical skills, ethical considerations, and the ongoing need for robust security practices.