A big problem is that the Windows platform has normalized the idea of 3rd party software running at the kernel level, and end users allow it because it's so normal. They've also normalized the idea of 3rd party software (even games) requiring Admin access to run, which is not as bad but a similar threat. Software that routinely requires elevated privileges seems to be a bad idea.
Ask HN: Can we blame Windows for CrowdStrike outage?
31–40 of 52 posts
Re: Ask HN: Can we blame Windows for CrowdStrike outage?
#32Kinda. Yes. Apple moved away from deep kernel extensions years ago. They are no longer permitted on their latest releases. Of course something like an EDR requires kernel level access otherwise it's too easy to bypass. But Apple has system extensions as a useful compromise. They're basically kernel level APIs that can be called by validated signed software. I think it's a good alternative to just allowing random code…
Back around 2000 or 2001 McAfee or Symantec (I can’t remember) released some virus definitions that caused Macs to kernel panic repeatedly. I worked at a college at the time which required students run it, and had to deal with the fallout. OS X was using Unix back then as well, and the foundational design didn’t save it. But like you mention, Apple does more to protect the underlying system today than they did back t…
> OS X was using Unix back then
IIRC OS X, and MacOS, are and have been certified UNIX for 20ish years.
Re: Ask HN: Can we blame Windows for CrowdStrike outage?
#33debatable but shit thats a bad pr
Re: Ask HN: Can we blame Windows for CrowdStrike outage?
#34Crowdstrike and other tools that have this access is for them to update their agents so that in case they see a ransomware or attack pattern to push it out to as many devices as possible to stem the attack. Do you need all this crazy level of kernel access, probably not, I hope they will have some refactoring efforts in the future.
> Do you need all this crazy level of kernel access, probably not
You absolutely do. Otherwise, you'll be unable to detect malware that IS putting itself into the kernel.
Re: Ask HN: Can we blame Windows for CrowdStrike outage?
#35debatable but shit thats a bad pr
and it just disclosed how much life and death situations rely on windows.
needs better safeguards.
Re: Ask HN: Can we blame Windows for CrowdStrike outage?
#36> Would it happen on Linux? It absolutely would. Windows is way ahead in terms of driver isolation and stability. Most drivers cannot bring down the system (your GPU driver can crash, your screen will flicker and maybe apps that were using it will crash, but the system recovers). Not so on Linux unfortunately, any driver will bring the system down. More recently certain class of drivers have been making use of ebpf o…
On my work machine, crowdstrike is using ebpf. Not loading any kernel modules.
Re: Ask HN: Can we blame Windows for CrowdStrike outage?
#37As far as I understand, yes. It's kind of astounding to me that the world has self-inflicted what is essentially a cyber attack trying to protect a poorly architected OS from actual cyber attacks when a much better architected OS is known and running on nearly all the servers in the world.
On Windows, software regularly mucks around in the kernel (device drivers, system level tools like wireshark, etc), therefore it is also necessary for security software like CrowdStrike to also muck in the kernel so it can monitor what all the other kernel level software is doing. As demonstrated today, anything that mucks in the kernel runs the risk of crashing the kernel.
In Linux, software doesn't even get that option. Nothing ever gets kernel access except the kernel itself. Root is not kernel access. The kernel still decides what root is able to do. Drivers that require that access are built into the kernel. Software that requires deeper access like Wireshark tells the kernel what to do (through system calls as root) and the kernel does it on that programs behalf. Therefore, the kernel knows everything that any program does on the system. With a trustworthy kernel, all that security software must do is instruct the kernel to monitor activity on it's behalf.
Re: Ask HN: Can we blame Windows for CrowdStrike outage?
#38Earlier quoted context omitted.
I have dealt with an apple upgrade that ignored free disk space and let users continue to upgrade eventually filling up the drive. This will happen with any company with humans that can make mistakes. And apple suffers from horrible ui issues also. Most users just tend to ignore them. On Macos, activate mission control and try to lock the screen with the keyboard shortcut.
Windows and macOS are both total shit.
For serious commercial servers - for sure, there is currently no alternative to linux
Re: Ask HN: Can we blame Windows for CrowdStrike outage?
#39As far as I understand, yes. It's kind of astounding to me that the world has self-inflicted what is essentially a cyber attack trying to protect a poorly architected OS from actual cyber attacks when a much better architected OS is known and running on nearly all the servers in the world. On Windows, software regularly mucks around in the kernel (device drivers, system level tools like wireshark, etc), therefore it…
> poorly architected OS
worth noting Microsoft had a solution a few years ago that would of prevented this issue from happening, Windows 10X, due to atomic updates.
> In Linux, software doesn't even get that option. Nothing ever gets kernel access except the kernel itself. Root is not kernel access.
root has kernel access, even if the kernel restricted it, it can write to the disk and change the boot process.
also worth nothing that a popular form of software distribution on Linux is curl http://randomscript.sh | sudo sh which is arguably worse than anything on Windows.
Re: Ask HN: Can we blame Windows for CrowdStrike outage?
#40Earlier quoted context omitted.
Back around 2000 or 2001 McAfee or Symantec (I can’t remember) released some virus definitions that caused Macs to kernel panic repeatedly. I worked at a college at the time which required students run it, and had to deal with the fallout. OS X was using Unix back then as well, and the foundational design didn’t save it. But like you mention, Apple does more to protect the underlying system today than they did back t…
> OS X was using Unix back then IIRC OS X, and MacOS, are and have been certified UNIX for 20ish years.
There are Linux distributions that have been certified UNIX, it really doesn't mean anything anymore.