Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Can we blame Windows for CrowdStrike outage?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 52 posts

Re: Ask HN: Can we blame Windows for CrowdStrike outage?

#41

Post by fortyseven »

PlutoIsAPlanet wrote: post #39
aptgetrekt wrote: post #37

As far as I understand, yes. It's kind of astounding to me that the world has self-inflicted what is essentially a cyber attack trying to protect a poorly architected OS from actual cyber attacks when a much better architected OS is known and running on nearly all the servers in the world. On Windows, software regularly mucks around in the kernel (device drivers, system level tools like wireshark, etc), therefore it…

> poorly architected OS worth noting Microsoft had a solution a few years ago that would of prevented this issue from happening, Windows 10X, due to atomic updates. > In Linux, software doesn't even get that option. Nothing ever gets kernel access except the kernel itself. Root is not kernel access. root has kernel access, even if the kernel restricted it, it can write to the disk and change the boot process. also wo…

I've yet to hear a convincing argument that any other installation method is more "secure".

Re: Ask HN: Can we blame Windows for CrowdStrike outage?

#42

Post by aptgetrekt »

PlutoIsAPlanet wrote: post #39
aptgetrekt wrote: post #37

As far as I understand, yes. It's kind of astounding to me that the world has self-inflicted what is essentially a cyber attack trying to protect a poorly architected OS from actual cyber attacks when a much better architected OS is known and running on nearly all the servers in the world. On Windows, software regularly mucks around in the kernel (device drivers, system level tools like wireshark, etc), therefore it…

> poorly architected OS worth noting Microsoft had a solution a few years ago that would of prevented this issue from happening, Windows 10X, due to atomic updates. > In Linux, software doesn't even get that option. Nothing ever gets kernel access except the kernel itself. Root is not kernel access. root has kernel access, even if the kernel restricted it, it can write to the disk and change the boot process. also wo…

Yeah that's true. Microsoft really needs to push forward with a new architecture at the core of windows. Stuff like what has happened today is inevitable under the current model where so much stuff has kernel level access. I just expected it to happen with something like anti cheat that doesn't have quite the oversight that I would assume CrowdStrike has in comparison.

Root has access to the kernel but the kernel knows everything that happens and that's my point. The kernel won't stop you from compiling a new kernel and setting it to run at the next boot. However, CrowdStrike running on Linux with eBPF for example would be able to identify and prevent such tampering without truly being in the kernel itself.

The most common way to install software on Linux is from your trusted distro repositories and from Flathub or the Snap store. Grabbing a script from the internet and piping it to a root shell is bad and something I'm sure we've all done. But take the most installed program on Windows which is likely Chrome, it really doesn't do anything differently. You download a small executable which requests admin, then it proceeds to download Chrome and install it. I'd argue grabbing a script might be the safer option because unlike installer executables from the internet, you at least have the option to read the script before running it if you choose.

Re: Ask HN: Can we blame Windows for CrowdStrike outage?

#43

Post by mcswell »

ryandrake wrote: post #31

A big problem is that the Windows platform has normalized the idea of 3rd party software running at the kernel level, and end users allow it because it's so normal. They've also normalized the idea of 3rd party software (even games) requiring Admin access to run, which is not as bad but a similar threat. Software that routinely requires elevated privileges seems to be a bad idea.

"They've also normalized the idea of 3rd party software (even games) requiring Admin access to run..." They have? Like what?

Re: Ask HN: Can we blame Windows for CrowdStrike outage?

#44

Post by commercialnix »

jiehong wrote: post #29
commercialnix wrote: post #23

Earlier quoted context omitted.

> Not so on Linux unfortunately, any driver will bring the system down. I work for a company that provides secure endpoints that are Linux based (and can also run Windows apps without issue). We do not ship Linux kernels that contain drivers that cause crashes. Per our IT patterns and also mandated by our commercial contracts, we investigate any crashes that occur. Over the last five years, not a single crash has bee…

It is a fact that Linux driver crashes causes a kernel crash, and it’s not that rare (like usb drivers). Even GPU drivers cause this [0]. But good job on not having a crash from a driver so far. Raspberry Pi users weren’t that lucky for example. [0]: https://forums.developer.nvidia.com/t/bug-report-455-23-04-k...

The Linux kernel images my company ships do not use the shit driver you are citing. We intentionally do not deploy hardware with these chips for this reason.

Yes there are tons of Linux images out there built by stupid people and thus crash all the time, which is not Linux' fault but the fault of those stupid people. As already should have been clear enough, or so I thought in the comment you replied t: my company doesn't ship stupid images built by stupid people.

Re: Ask HN: Can we blame Windows for CrowdStrike outage?

#45

Post by [deleted] »

jiehong wrote: post #29
commercialnix wrote: post #23

Earlier quoted context omitted.

> Not so on Linux unfortunately, any driver will bring the system down. I work for a company that provides secure endpoints that are Linux based (and can also run Windows apps without issue). We do not ship Linux kernels that contain drivers that cause crashes. Per our IT patterns and also mandated by our commercial contracts, we investigate any crashes that occur. Over the last five years, not a single crash has bee…

It is a fact that Linux driver crashes causes a kernel crash, and it’s not that rare (like usb drivers). Even GPU drivers cause this [0]. But good job on not having a crash from a driver so far. Raspberry Pi users weren’t that lucky for example. [0]: https://forums.developer.nvidia.com/t/bug-report-455-23-04-k...

[deleted]

Re: Ask HN: Can we blame Windows for CrowdStrike outage?

#46

Post by [deleted] »

jiehong wrote: post #29
commercialnix wrote: post #23

Earlier quoted context omitted.

> Not so on Linux unfortunately, any driver will bring the system down. I work for a company that provides secure endpoints that are Linux based (and can also run Windows apps without issue). We do not ship Linux kernels that contain drivers that cause crashes. Per our IT patterns and also mandated by our commercial contracts, we investigate any crashes that occur. Over the last five years, not a single crash has bee…

It is a fact that Linux driver crashes causes a kernel crash, and it’s not that rare (like usb drivers). Even GPU drivers cause this [0]. But good job on not having a crash from a driver so far. Raspberry Pi users weren’t that lucky for example. [0]: https://forums.developer.nvidia.com/t/bug-report-455-23-04-k...

[deleted]

Re: Ask HN: Can we blame Windows for CrowdStrike outage?

#47

Post by commercialnix »

jiehong wrote: post #29
commercialnix wrote: post #23

Earlier quoted context omitted.

> Not so on Linux unfortunately, any driver will bring the system down. I work for a company that provides secure endpoints that are Linux based (and can also run Windows apps without issue). We do not ship Linux kernels that contain drivers that cause crashes. Per our IT patterns and also mandated by our commercial contracts, we investigate any crashes that occur. Over the last five years, not a single crash has bee…

It is a fact that Linux driver crashes causes a kernel crash, and it’s not that rare (like usb drivers). Even GPU drivers cause this [0]. But good job on not having a crash from a driver so far. Raspberry Pi users weren’t that lucky for example. [0]: https://forums.developer.nvidia.com/t/bug-report-455-23-04-k...

> It is a fact that Linux driver crashes causes a kernel crash

See what was already written in the comment you replied to:

  We do not ship Linux kernels that contain drivers that cause crashes.
We do not ship drivers that crash, hence they do not cause a crash.

Re: Ask HN: Can we blame Windows for CrowdStrike outage?

#48

Post by 1vuio0pswjnm7 »

HN commenters will defend the quality of Windows.

Windows is closed source for the vast majority of people who use it. No one oustide Microsoft, not even those who may have signed NDAs and can read some of the code, is free to edit the Windows source and recompile. If a Windows user wants to prevent something like this outage from happening, he cannot obtain the Windows source and make changes to prevent it. Instead he is encouraged (perhaps compelled) to let Microsoft remotely install and run new code any time it wants.

Re: Ask HN: Can we blame Windows for CrowdStrike outage?

#49

Post by al_borland »

fouc wrote: post #17
al_borland wrote: post #6

Earlier quoted context omitted.

Back around 2000 or 2001 McAfee or Symantec (I can’t remember) released some virus definitions that caused Macs to kernel panic repeatedly. I worked at a college at the time which required students run it, and had to deal with the fallout. OS X was using Unix back then as well, and the foundational design didn’t save it. But like you mention, Apple does more to protect the underlying system today than they did back t…

Given the dates 2000/2001 you mentioned it sounds more like Classic Mac OS than Mac OS X (which wasn't released until March 24, 2001)

Sorry, my timeline was messed up. It was around 2004/5.

If was OS X for sure, Tiger to be specific.

Re: Ask HN: Can we blame Windows for CrowdStrike outage?

#50

Post by TowerTall »

wkat4242 wrote: post #4

Kinda. Yes. Apple moved away from deep kernel extensions years ago. They are no longer permitted on their latest releases. Of course something like an EDR requires kernel level access otherwise it's too easy to bypass. But Apple has system extensions as a useful compromise. They're basically kernel level APIs that can be called by validated signed software. I think it's a good alternative to just allowing random code…

Back in Windows Vista Microsoft removed access to the kernel making the CrowdStrike incident impossible. Microsoft had stated that no companies would be allowed to access Vista's core for security reasons, but Symantec launched an official complaint over the matter with the European Union and eventually Microsoft caved in.

https://arstechnica.com/information-technology/2006/10/7998/

Post reply on HN