微软将于11月上旬把 .msix 和 .msixbundle 加入 Outlook 的阻止附件列表，此举堵住了一条电子邮件投递途径——微软自己的威胁研究人员曾于2023年发现有四个犯罪团伙滥用这种打包格式。重命名扩展名仍然可以通过该打包文件，此次调整将作为默认策略修改下发至每一个 Exchange Online 租户，其中包括目前正试图离开的欧洲各国政府的租户。
Microsoft will add .msix and .msixbundle to Outlook’s blocked attachment list in early November, closing an email route for a packaging format its own threat researchers watched four criminal groups abuse in 2023. Renaming the extension still gets a package through, and the change lands as a default policy edit in every Exchange Online tenant, including those of European governments now trying to leave.
从11月上旬开始，网页版 Outlook 和新的 Windows 版 Outlook 将阻止用户打开或下载这两种附件。两者皆为微软自己的 Windows 安装程序格式。微软表示，大多数组织不会注意到这一变化。
From early November, Outlook on the web and the new Outlook for Windows will stop users opening or downloading two kinds of attachment. Both are Microsoft’s own Windows installer formats. Microsoft says most organisations will not notice.
10月5日发布的公告 MC1488841 将这两种格式同时加入了默认的 Outlook 网页版邮箱策略以及租户中的每个自定义策略。部署工作将从11月上旬持续到月中。根据微软的支持文档，需要使用这些格式的管理员必须首先将其添加到允许列表中。
Notice MC1488841, published on 5 October, adds both to the default Outlook web mailbox policy and to every custom policy in a tenant. Rollout runs from early November to mid-month. Administrators needing the formats must add them to an allowed list first, per Microsoft’s support documentation.
MSIX 是微软为取代 .exe 和 .msi 而引入的打包格式。一个安装包（bundle）中包含某个应用程序的多个构建版本，以便 Windows 安装正确的版本。微软商店（Microsoft Store）的应用便使用该格式。微软构建该格式的初衷是使其比它所取代的格式更安全。
MSIX is the packaging format Microsoft introduced to replace .exe and .msi. A bundle holds several builds of one application, so Windows installs the right one. Microsoft Store apps use it. Microsoft built the format to be safer than what it replaced.
但情况并非如此。2023年12月，微软默认禁用了 ms-appinstaller 协议处理程序，此前有四个以金钱为动机的团伙对其进行了滥用，这些团伙被追踪为 Storm-0569、Storm-1113、Sangria Tempest 和 Storm-1674。
That did not hold. In December 2023 Microsoft disabled the ms-appinstaller protocol handler by default after four financially motivated groups abused it, tracked as Storm-0569, Storm-1113, Sangria Tempest and Storm-1674.
微软威胁情报团队撰文称，他们分发了 BATLOADER、EugenLoader、IcedID、DarkGate 以及 Black Basta 勒索软件。该处理程序绕过了 Defender SmartScreen 以及通常在下载可执行文件时出现的浏览器警告。
They delivered BATLOADER, EugenLoader, IcedID, DarkGate and Black Basta ransomware, Microsoft’s threat intelligence team wrote. The handler bypassed Defender SmartScreen and the browser warnings that greet an executable download.
微软此次并未提及任何攻击事件，且阻止范围较窄。重命名扩展名或发送下载链接仍可使打包文件绕过拦截。在 NIS2 法规下，欧洲的24小时报告倒计时是从组织注意到问题时开始计算，而不是从客户端拒绝某个文件时开始。
Microsoft cited no attack this time, and the block is narrow. Renaming the extension or sending a download link gets a package past it. Europe’s 24-hour reporting clock under NIS2 starts when an organisation notices, not when a client refuses a file.
它加入的这份清单比该集节目所暗示的要更早。据 BleepingComputer 报道，在 2019 年 9 月之前，Outlook on the Web 就已经屏蔽了 104 个扩展程序，而微软随后又增加了 38 个，其中包括 Python 和 PowerShell。
The list it joins is older than that episode suggests. Outlook on the web blocked 104 extensions before September 2019, when Microsoft added 38 more, including Python and PowerShell, BleepingComputer reported.
真正的新变化在于这一限制的实施方式。微软正在修改每个 Exchange Online 租户的默认策略，包括欧洲各国的政府机构；任何希望保留旧有设置的用户都必须主动选择退出。本周，荷兰税务局决定将其电子邮件服务从该云平台上迁移出去。其理由与附件毫无关系。
What is new is how it arrives. Microsoft is editing the default policy in every Exchange Online tenant, European governments included, and anyone wanting the old behaviour must opt out. The Dutch tax office decided this week to move its email off that cloud. Its reasons had nothing to do with attachments.
荷兰税务局（Belastingdienst）、海关和福利机构拥有 47,500 名员工，他们指出，现有系统缺乏加密控制措施，也没有可行的退出策略。今年 4 月，法国的举措更为激进，要求各政府部门转向自主可控的电子邮件替代方案，覆盖 250 万名公务员。
The Belastingdienst, Dutch Customs and the Benefits Agency, 47,500 staff, cited missing encryption controls and no workable exit strategy. France went further in April, ordering ministries towards sovereign alternatives for email, covering 2.5 million civil servants.
屏蔽安装程序格式只是例行清理。真正的问题在于：谁拥有决策权？
Blocking an installer format is housekeeping. The complaint underneath is about who decides.
欧盟委员会提出的《云与人工智能发展法案》将要求敏感公共工作负载符合欧盟的本土化所有权要求，而亚马逊、微软和谷歌目前尚无法满足这一条件。在该法案通过之前，欧洲公共部门电子邮件的管理政策仍由微软在雷德蒙德制定，并在之后才对外公布。
The Commission’s proposed Cloud and AI Development Act would put sensitive public workloads behind EU ownership requirements Amazon, Microsoft and Google cannot currently meet. Until it passes, the policy governing Europe’s public sector email is written in Redmond, and announced afterwards.