ms-teams-rce VS lots

Just adding this here for people who think Teams is secure: https://github.com/oskarsve/ms-teams-rce

So als Beispiel https://github.com/oskarsve/ms-teams-rce

> They tend to react with "either you can show us that this is a real danger or we'll ignore it".

This is a bit of a Catch-22 situation, as I get the feeling that proving the danger would often involve doing things that bounty programs specifically forbid, such as "Moving beyond “proof of concept” repro steps"[0]. That may be part of the reason why Microsoft got away with such a stingy response to the RCE vulnerability found in Teams by Oskars Vegeris.[1]

[0] https://www.microsoft.com/en-us/msrc/bounty-online-services?...

[1] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md

There's another angle to this that was discussed on the Risky Business[0] podcast a while back, namely the security angle. As the recent Microsoft Team's vulnerability[1] illustrated, with many Electron apps any XSS vulnerability turns into RCE. Personally I am moving away from Slack, Discord, and other electron apps like them. The browser sandbox ensures that XSS is "only" XSS and doesn't turn into RCE as well.

0: https://www.risky.biz/

1: https://github.com/oskarsve/ms-teams-rce

Munich has been heavy users of Linux since 2003, and has a lot of workflow built using LibreOffice. It would be easy to switch to Windows, because LibreOffice runs on Windows, but to change word processors would require re-engineering all that, one assumes.