Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft's global sprawl under fire from regulators after Windows outage

washingtonpost.com

Post reply on HN
Print view View original

81–90 of 104 posts

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#81

Post by jkrejcha »

Hikikomori wrote: post #67
gruez wrote: post #60

Earlier quoted context omitted.

>There is a frustrating amount of nuance being lost in this discussion, and as usual it's devolving into tribalism. It's ironic that you're saying this given the points you're making below. Let's go through them: >Are kernel mode drives maybe a bad idea? Yes! You can't have a EDR product that isn't kernel mode. Otherwise it's trivial for malware to evade (eg. by being kernel mode themselves). >Should Windows be able…

Mac doesn't allow 3rd part kernel drivers and on Linux they use ebpf. Is their product useless there?

> and on Linux

On Linux, they apparently had done the same thing and caused a bunch of Linux systems to crash[1].

[1]: https://www.neowin.net/news/crowdstrike-broke-debian-and-roc...

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#82

Post by thayne »

gruez wrote: post #75
thayne wrote: post #70

Earlier quoted context omitted.

> Because only Crowdstrike's Windows release was broken by them and they didn't fuck it up on the other OS. How is this Window's fault? First of all, whether it is actually Window's fault or not isn't the point. What matters is the perception by the general public and policy makers. And maybe it could have just as easily happened on another OS, but the reason why is somewhat technical, so people who have an agenda ca…

>> Because only Crowdstrike's Windows release was broken by them and they didn't fuck it up on the other OS. How is this Window's fault? >First of all, whether it is actually Window's fault or not isn't the point. What matters is the perception by the general public and policy makers Way to move the goalposts from "How is this Window's fault" to "the perception by the general public and policy makers". I don't think…

I'm sorry if my original comment wasn't clear enough. My original intent was not to say that it was Microsofts fault. Rather that it isn't surprising that some people with limited knowledge and/or understanding of the relevant details might blame Microsoft, and that people with an axe to grind on Microsoft would take advantage of that potential misunderstanding.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#83

Post by russellbeattie »

jenadine wrote: post #39
russellbeattie wrote: post #28

Microsoft's culpability lies in the fact that their OS is still ridiculously brittle. How it can't seem to manage to be able to automatically roll back changes from something as serious as a kernel change is ludicrous. It's CrowdStrike's fault that the kernel was faulty. It's Microsoft's fault that it caused a never ending bootloop that needed manual intervention to fix.

From what I understand, the problem was not caused by an update of the driver itself, but an update of a config file that the driver uses. As an OS author, how could you possibly know what to rollback when this is just an unrelated file fron a third party? Maybe you could try to rollback the whole file system to a previous snapshot? Assuming the file system supports automated snapshots, that might work, but this also…

Oh, I didn't know that it was just a config file, thanks. I'm not sure if this makes it better though. The idea that an update to a single text file used by a third party Windows service can take down the whole OS permanently is a bit extreme, no?

Windows BSODs have been a reality for a long as it has existed. There's no reason at this point any third party software should be able to cause it. Hardware fault? Sure. Badly installed or configured driver? Crazy.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#84

Post by josephcsible »

gruez wrote: post #77
fredski42 wrote: post #73

Earlier quoted context omitted.

Totally agree here. There should be a mechanism to go back to ‘last known good’ regardless of kernel level issues. Innovations like Fedora Silverblue with ostree and greenboot tech should be adopted by Windows.

>There should be a mechanism to go back to ‘last known good’ regardless of kernel level issues. Innovations like Fedora Silverblue with ostree and greenboot tech should be adopted by Windows. Can you explain how they work? AFAIK the issue is that they pushed a bad config file, and that's the thing that caused the crash, not a new driver. Are those systems going to roll back every file ever to try to recover themselve…

> Are those systems going to roll back every file ever to try to recover themselves?

Isn't that totally feasible with things like Btrfs snapshots?

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#85

Post by eddyg »

TeaBrain wrote: post #59
amluto wrote: post #31

I’m not a regulator, but I think the solution may actually be to break up Microsoft. Right now, there is a product that is critical to the economy: Windows. By “Windows” I mean the OS, its security mechanisms, and its update mechanisms. Changing Windows to a multi-source model seems challenging, to say the least. Right now, though, Windows is not merely single-source, but that single source also makes OneDrive, Offic…

This is the narrative that Crowdstrike wants the public to believe. Crowdstrike did the same thing to Debian machines running their software previously. The use of these kernel-level security software packages with arguably negligible benefit compared to the experienced risks could instead be reassessed.

Not just Debian. RHEL too.

Kernel panic observed after booting 5.14.0-427.13.1.el9_4.x86_64 by falcon-sensor process : https://access.redhat.com/solutions/7068083

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#86

Post by pjmlp »

guidedlight wrote: post #58
gruez wrote: post #56

Earlier quoted context omitted.

>Microsoft are signing kernel drivers for over-the-air updates pushed by vendors. The crash was caused by a configuration update pushed by crowdstrike, not a new driver. >Whilst telling their corporate customers that using Microsoft InTune will allow them to be in full control of their configuration management. How is this relevant? This wasn't caused by some sysadmin that goofed a config change using intune, it's so…

> The crash was caused by a configuration update pushed by crowdstrike, not a new driver. Microsoft didn’t do enough due diligence on the behaviour of CrowdStrike updates. It shouldn’t allow out-of-band updates. Third-parties should not be signing code that allows third-parties to reach into corporate services and push files. Microsoft InTune is the mechanism that all configuration updates should use. It appears to m…

Basically more iOS, less PC.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#87

Post by surfingdino »

averageRoyalty wrote: post #72
surfingdino wrote: post #44

Earlier quoted context omitted.

From the point of view of a lay person Microsoft was caught asleep at the wheel. It allowed high levels of privileged access to their customers' systems. Anti-malware software ought to be monitored and scrutinised by Microsoft's own security teams no matter that it was the customers who wanted to/were told to use CrowdStrike. But I guess they spend too much on silly fidget-widgets like OpenAI to have a budget to watc…

If I design and sell a car and you electrocute yourself replacing a head unit cutting wires - despite warnings from me saying "I don't recommend replacing the head unit, it could be dangerous. I've provided you one with basic functionality" - can you reasonably argue that I should have made it harder to replace head units, or been out auditing third party head units on the market? Your argument is anti software freed…

A car manufacturer cannot stop you from cutting the wires, an OS vendor can monitor what is going on with your computer in real time so they are more than capable of implementing a process for verification of third-party software.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#88

Post by averageRoyalty »

surfingdino wrote: post #87
averageRoyalty wrote: post #72

Earlier quoted context omitted.

If I design and sell a car and you electrocute yourself replacing a head unit cutting wires - despite warnings from me saying "I don't recommend replacing the head unit, it could be dangerous. I've provided you one with basic functionality" - can you reasonably argue that I should have made it harder to replace head units, or been out auditing third party head units on the market? Your argument is anti software freed…

A car manufacturer cannot stop you from cutting the wires, an OS vendor can monitor what is going on with your computer in real time so they are more than capable of implementing a process for verification of third-party software.

With modems in modern cars, a car manufacturer could absolutely monitor wire resistence and "shut down" a wire remotely. Most people would agree however that's unnecessary and invasive.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#89

Post by guidedlight »

gruez wrote: post #61
guidedlight wrote: post #58

Earlier quoted context omitted.

> The crash was caused by a configuration update pushed by crowdstrike, not a new driver. Microsoft didn’t do enough due diligence on the behaviour of CrowdStrike updates. It shouldn’t allow out-of-band updates. Third-parties should not be signing code that allows third-parties to reach into corporate services and push files. Microsoft InTune is the mechanism that all configuration updates should use. It appears to m…

>Microsoft didn’t do enough due diligence on the behaviour of CrowdStrike updates. It shouldn’t allow out-of-band updates. You want Microsoft to be doing code reviews of third party software? That might have prevented this disaster but would get them in hot waters for other reasons (eg. anti-competition accusations). Not even Apple gatekeeps that hard. >Third-parties should not be signing code that allows third-parti…

We’re talking about kernel drivers here.

I think they warrant some extra attention by Microsoft.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#90

Post by dissent »

gruez wrote: post #6

It seems baffling that Microsoft is getting heat for this. They didn't cause the issue, a third party vendor's software did. Even if you were trying to make an argument of "if we had more diversity it wouldn't be as bad", shouldn't you be focusing on the EDR vendors rather than the OS vendor?

I go the other way, it's absolutely their fault. Their historical business model of monopolizing the enterprise while outsourcing security is at the root of all this. The same thing could happen with Crowdstrike on other platforms, but it's only on Windows where these suites are considered essential.
Post reply on HN