Microsoft Tech Community

I was actually looking for a test site that could do that, like we have dnssec-failed.org - saves me setting up the target servers themselves

DANE requires a provider to validate DNSSEC. I know not all of them do that. DANE takes it even a step further, so I'm going to assume even fewer providers implement that

Microsoft specifically announced it last februari for Exchange Online (not really a SMTP SaaS like eg. send grid) so it's special enough that it's worthy of an announcement - https://techcommunity.microsoft.com/t5/exchange-team-blog/releasing-outbound-smtp-dane-with-dnssec/ba-p/3100920

I emailed postmark if they supported STARTTLS/DANE, they replied they supported opportunistic STARTTLS. Not an outright "No" but might be a failure to understand the questions

So plenty of reasons to not assume DANE is implemented unless a provider can actually confirm it is.

First, Azure runs on Windows, using Azure Host OS at the lowest layer.

https://techcommunity.microsoft.com/t5/windows-os-platform-blog/azure-host-os-cloud-host/ba-p/3709528

Secondly, unless you are doing classical VM deployments, the only thing we care about are type 1 hypervisors.

If the language runtimes are running directly on top of a type-1 hypervisor, some kind of container, or bare metal, it is mostly irrelevant for most languages, with exception of C and C++ with their direct dependency on POSIX related APIs.

Taken to the extreme, on serveless workloads, you can even upload the code, and it get magically transformed into a deployment, mostly using managed languages that are OS agnostic.

At the end of the day, if those type-1 hypervisors are self-contained, or need a guest OS as management node, is completly transparent to the managed runtime workloads.

All versions of Windows Server are (for now) unaffected, i.e., Internet Explorer 11 continues to run [1].

There is also "Internet Explorer Mode" in Edge, which uses iexplore.exe under the hood.

Additionally, if somebody were _really_ desperate to launch iexplore.exe itself, then there are unsupported means to do so.

For example, via manually modifying the registry key "NotifyDisableIEOptions" under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\

My favourite hack though, which should not be used by anyone ever, is launching via the COM object interface, which bypasses the registry key check [2]. I have personally verified that this works(!)

[1] https://techcommunity.microsoft.com/t5/windows-it-pro-blog/internet-explorer-11-desktop-app-retirement-faq/ba-p/2366549

[2] https://twitter.com/aaaddress1/status/1523590203658862592

If only their tech stack was at the same level.

No joke. Sometimes I appreciate the way Azure has chosen to differentiate itself in terms of developer experience.

Then there are times using it when I want to walk into an ocean.

Interestingly, those times seem to be anytime I have to deal with Application Insights or LogAnalytics. Azure, if anyone working on those two products are reading this, y’all need to go read up on this thing called ‘correlation’ because the Azure native logging and APM is…

whistles

boy.

It’s something. I just love waiting 5-15 minutes just to see a log line, if I even see it at all with how routinely problematic and unstable their logging infrastructure is[1]

[1] https://techcommunity.microsoft.com/t5/azure-monitor-status/bg-p/AzureMonitorStatusBlog

(We’re already looking to get away from LA though)

I don't understand why you are making such a critical reply. LTS versions of operating systems have been a standard thing for years. Even some Linux distros do it (did? do they still).

Also a simple google search would have shown otherwise. https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-client-roadmap-update-april-2023/ba-p/3805227 Windows 11 LTSC was announced for next year.

Given how Windows 10 LSTC differed strongly from all of the crap they added to normal 10, right now I am leaning towards that Windows 11 will likely follow a similar cut down version of Windows without all of the crap.

LTSC isn't going away, at least not right now. When it does then we can talk about Linux again but right now there is a perfectly valid option without any compatibility issues.

Sysmon [1] is a popular monitoring tool on Windows. It is based on ETW and its custom driver and provides great details on what is happening in the system. To make the logs relevant, we need to configure it (SwiftOnSecurity created a good base config file [2]).

Yesterday, MS released the first version of Sysmon for Linux and made it open-source (MIT license)[3]. It is based on eBPF. In [4] they show how they use it in Azure to collect events from the Linux VMs.

- [1] https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon

- [2] https://github.com/SwiftOnSecurity/sysmon-config

- [3] https://github.com/Sysinternals/SysmonForLinux

- [4] https://techcommunity.microsoft.com/t5/azure-sentinel/automating-the-deployment-of-sysmon-for-linux-and-azure-sentinel/ba-p/2847054