In November 2021 both Samba and Windows released very similar security updates. By December 2021 other security researchers had publicly worked out what happened. This is the story of the year prior, the ups and downs of coordinated disclosure and important lessons learnt dealing with MSRC.
Andrew Bartlett will show how a choice in the implementations of and interaction between Kerberos and other parts of Active Directory was in fact a critical vulnerability hidden in plain sight.
Finally, Andrew will note that while MachineAccountQuota is a terrible idea, there is no value in being sumg: Samba ended up just as bad even without that ‘feature'.