Microsoft's global sprawl under fire from regulators after Windows outage • Hacker News Board

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#61

Post by gruez » Sat, Jul 20, 2024, 11:00 PM UTC

guidedlight wrote: post #58

gruez wrote: post #56

Earlier quoted context omitted.

>Microsoft are signing kernel drivers for over-the-air updates pushed by vendors. The crash was caused by a configuration update pushed by crowdstrike, not a new driver. >Whilst telling their corporate customers that using Microsoft InTune will allow them to be in full control of their configuration management. How is this relevant? This wasn't caused by some sysadmin that goofed a config change using intune, it's so…

> The crash was caused by a configuration update pushed by crowdstrike, not a new driver. Microsoft didn’t do enough due diligence on the behaviour of CrowdStrike updates. It shouldn’t allow out-of-band updates. Third-parties should not be signing code that allows third-parties to reach into corporate services and push files. Microsoft InTune is the mechanism that all configuration updates should use. It appears to m…

>Microsoft didn’t do enough due diligence on the behaviour of CrowdStrike updates. It shouldn’t allow out-of-band updates.

You want Microsoft to be doing code reviews of third party software? That might have prevented this disaster but would get them in hot waters for other reasons (eg. anti-competition accusations). Not even Apple gatekeeps that hard.

>Third-parties should not be signing code that allows third-parties to reach into corporate services and push files.

So dropbox should be banned as well? It's also a third party service that pushes files onto computers.

>Microsoft InTune is the mechanism that all configuration updates should use.

Okay, so crowdstrike pushes its virus definition updates via intune instead. The bad file still lands on computers, the kernel mode driver still crashes before the computer can boot and the computer is bricked. How is this any better?

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#62

Post by gruez » Sat, Jul 20, 2024, 11:01 PM UTC

dlahoda wrote: post #25

dlahoda wrote: post #21

Earlier quoted context omitted.

how 8.5M devices got approval to install? may they came with hard to disable windows autoupdate?

gpt said it could be updated by ms https://chatgpt.com/share/8eca1a08-062f-4474-9310-95444bab67...

That's irrelevant when crowdstrike admitted it's caused by them.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#63

Post by yjftsjthsd-h » Sat, Jul 20, 2024, 11:04 PM UTC

TeaBrain wrote: post #59

amluto wrote: post #31

I’m not a regulator, but I think the solution may actually be to break up Microsoft. Right now, there is a product that is critical to the economy: Windows. By “Windows” I mean the OS, its security mechanisms, and its update mechanisms. Changing Windows to a multi-source model seems challenging, to say the least. Right now, though, Windows is not merely single-source, but that single source also makes OneDrive, Offic…

This is the narrative that Crowdstrike wants the public to believe. Crowdstrike did the same thing to Debian machines running their software previously. The use of these kernel-level security software packages with arguably negligible benefit compared to the experienced risks could instead be reassessed.

AIUI new Debian supports enough ebpf that it doesn't need an unsandboxed kernel module, which is a useful point of comparison. Though yeah, an OS can only do so much to limit a problem running with root, and security software legitimately needs a lot of power.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#64

Post by xboxnolifes » Sat, Jul 20, 2024, 11:05 PM UTC

ehsankia wrote: post #46

gruez wrote: post #6

It seems baffling that Microsoft is getting heat for this. They didn't cause the issue, a third party vendor's software did. Even if you were trying to make an argument of "if we had more diversity it wouldn't be as bad", shouldn't you be focusing on the EDR vendors rather than the OS vendor?

I'm curious what people think, but while obviously CrowdStrike caused the breakage, does the Operating System not have some responsibility in not allowing such outages to happen? Especially if it's an enterprise product? Ideas: 1. Microsoft themselves could potentially enforce a gradual rollout on updates (did the update go through windows updates?) 2. Have better automatic recovery options, could windows have detect…

I'd expect the HN crowd to not give Microsoft beef here or want them to lock down the OS more. At least, that would be consistent with usual comments about letting users control their OS. Companies chose (with some regulatory pressure) to install CrowdStrike at the kernel level after all.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#65

Post by seanmcdirmid » Sat, Jul 20, 2024, 11:06 PM UTC

jacooper wrote: post #36

amluto wrote: post #31

I’m not a regulator, but I think the solution may actually be to break up Microsoft. Right now, there is a product that is critical to the economy: Windows. By “Windows” I mean the OS, its security mechanisms, and its update mechanisms. Changing Windows to a multi-source model seems challenging, to say the least. Right now, though, Windows is not merely single-source, but that single source also makes OneDrive, Offic…

Ironically I think Microsoft losing windows won't hurt them that much, it will however benefit consumers for sure.

I don’t think Windows would survive for very long without other Microsoft businesses subsidizing their revenue. It might go on for a few years, but it would basically move up Linux and OSX quickly to corporate desktop status, while Windev goes bankrupt as a non-viable business.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#66

Post by bsder » Sat, Jul 20, 2024, 11:06 PM UTC

bilekas wrote: post #15

lambdaone wrote: post #2

It was inevitable that something like this would happen sooner or later, either through security complacency or sheer bad luck. We were just fortunate it only happened to Windows.

I'm of two minds on this one personally. I see simular `single points of failure` potentials with CloudFlare for example. Sometimes it highlights this topic. But at the same time, I really do feel more comfortable with a large experienced company being responsible for some of that infrastructure that is expensive to maintain correctly.. I don't know what the solution is, but it's something that needs to be figured ou…

> I don't know what the solution is, but it's something that needs to be figured out.

The "solution" is that you bust up large companies until their market share of a vertical is less than 20%.

The fact that Microsoft controls 75%+ of the desktop/laptop market should get that pulled out of the company and broken up. The fact that Google and Microsoft control the email hosting market should get pulled out and broken up, etc.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#67

Post by Hikikomori » Sat, Jul 20, 2024, 11:08 PM UTC

gruez wrote: post #60

rewgs wrote: post #54

Earlier quoted context omitted.

There is a frustrating amount of nuance being lost in this discussion, and as usual it's devolving into tribalism. However, I'll say that, while this clearly is not Microsoft's fault, the realization of just how much critical infrastructure is running on Windows -- let alone Windows that's connected to the internet and has automatic updates enabled -- was sobering. Are kernel mode drives maybe a bad idea? Yes! Should…

>There is a frustrating amount of nuance being lost in this discussion, and as usual it's devolving into tribalism. It's ironic that you're saying this given the points you're making below. Let's go through them: >Are kernel mode drives maybe a bad idea? Yes! You can't have a EDR product that isn't kernel mode. Otherwise it's trivial for malware to evade (eg. by being kernel mode themselves). >Should Windows be able…

Mac doesn't allow 3rd part kernel drivers and on Linux they use ebpf. Is their product useless there?

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#68

Post by gruez » Sat, Jul 20, 2024, 11:15 PM UTC

Hikikomori wrote: post #67

gruez wrote: post #60

Earlier quoted context omitted.

>There is a frustrating amount of nuance being lost in this discussion, and as usual it's devolving into tribalism. It's ironic that you're saying this given the points you're making below. Let's go through them: >Are kernel mode drives maybe a bad idea? Yes! You can't have a EDR product that isn't kernel mode. Otherwise it's trivial for malware to evade (eg. by being kernel mode themselves). >Should Windows be able…

Mac doesn't allow 3rd part kernel drivers and on Linux they use ebpf. Is their product useless there?

>Is their product useless there?

Probably? For instance I doubt an EDR product can detect malware being executed on iOS/Android, because all the apps there are heavily sandboxed and provide no mechanism to do invasive monitoring of everything's that's being run.

>Linux they use ebpf

According to wikipedia it's been ported to windows and on linux you can still load kernel modules which are crashable.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#69

Post by averageRoyalty » Sat, Jul 20, 2024, 11:21 PM UTC

guidedlight wrote: post #58

gruez wrote: post #56

Earlier quoted context omitted.

>Microsoft are signing kernel drivers for over-the-air updates pushed by vendors. The crash was caused by a configuration update pushed by crowdstrike, not a new driver. >Whilst telling their corporate customers that using Microsoft InTune will allow them to be in full control of their configuration management. How is this relevant? This wasn't caused by some sysadmin that goofed a config change using intune, it's so…

> The crash was caused by a configuration update pushed by crowdstrike, not a new driver. Microsoft didn’t do enough due diligence on the behaviour of CrowdStrike updates. It shouldn’t allow out-of-band updates. Third-parties should not be signing code that allows third-parties to reach into corporate services and push files. Microsoft InTune is the mechanism that all configuration updates should use. It appears to m…

Why are you arguing about the responsibility of MS or CS when the owner of these enterprise computers is clearly the one responsible for what's on them? The companies affected are the ones who chose to install the software and run it with the inherit risks.

> Microsoft InTune is the mechanism that all configuration updates should use.

That would make it one of the most locked down operating systems in the world, killing millions of applications overnight. Enterprise IT already have the ability to control installs, updates and patches, why move that burden to Microsoft?

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#70

Post by thayne » Sat, Jul 20, 2024, 11:24 PM UTC

Rinzler89 wrote: post #45

thayne wrote: post #41

Earlier quoted context omitted.

Is it baffling? Only windows computers were affected, so this provides ammunition for people who are already concerned about the prevalence of windows. I think this is more politically motivated than actually trying to address the real problem. However I do, think Microsoft deserves some blame, since if Windows was more secure by default there would be less need for 3rd party anti-malware software that can fail so ca…

>Only windows computers were affected Because only Crowdstrike's Windows release was broken by them and they didn't fuck it up on the other OS. How is this Window's fault? It's not like that tool was binary cross platform compatible for all operating systems, like Electron VS Code, in order to put the blame on the OS. It's basically a complete different tool tailored to each OS kernel, under the same brand name. > if…

> Because only Crowdstrike's Windows release was broken by them and they didn't fuck it up on the other OS. How is this Window's fault?

First of all, whether it is actually Window's fault or not isn't the point. What matters is the perception by the general public and policy makers. And maybe it could have just as easily happened on another OS, but the reason why is somewhat technical, so people who have an agenda can spin it as being MS's fault.

Secondly, it is possible, although I don't think terribly probable, that the bug was influenced by some quirk of the windows platform, although it is impossible to know without more details of the exact nature of the bug.