Microsoft's global sprawl under fire from regulators after Windows outage • Hacker News Board

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#101

Post by number6 » Sun, Jul 21, 2024, 6:20 PM UTC

TeaBrain wrote: post #59

amluto wrote: post #31

I’m not a regulator, but I think the solution may actually be to break up Microsoft. Right now, there is a product that is critical to the economy: Windows. By “Windows” I mean the OS, its security mechanisms, and its update mechanisms. Changing Windows to a multi-source model seems challenging, to say the least. Right now, though, Windows is not merely single-source, but that single source also makes OneDrive, Offic…

This is the narrative that Crowdstrike wants the public to believe. Crowdstrike did the same thing to Debian machines running their software previously. The use of these kernel-level security software packages with arguably negligible benefit compared to the experienced risks could instead be reassessed.

There was also a Microsoft 365 outage. On the other hand is Microsoft also known to push faulty updates

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#102

Post by rstuart4133 » Sun, Jul 21, 2024, 9:25 PM UTC

josephcsible wrote: post #80

ehsankia wrote: post #46

Earlier quoted context omitted.

I'm curious what people think, but while obviously CrowdStrike caused the breakage, does the Operating System not have some responsibility in not allowing such outages to happen? Especially if it's an enterprise product? Ideas: 1. Microsoft themselves could potentially enforce a gradual rollout on updates (did the update go through windows updates?) 2. Have better automatic recovery options, could windows have detect…

> does the Operating System not have some responsibility in not allowing such outages to happen? No. The OS is supposed to guarantee that userspace programs can't crash the system like this, but CrowdStrike is an invasive kernelspace driver, not a userspace program.

Phone OS's are counter examples. Their app isolation is so strong they don't need anti virus software. Effectively all a virus gets to access to without explicit user permission is itself and the user. In particular it doesn't get to screw with the OS itself, nor with the features the OS reserves for the user like installing and uninstalling, and turning permissions on and off.

Granted, just giving the virus access to the user creates problems. While the virus can't directly change it's permissions, it can socially manipulate the user into doing it for them. But even so it's fixable in the sense it doesn't take a wipe and install and the user can always just uninstall the virus.

So yes, the OS can prevent this problem entire by implementing strong access controls. The problem isn't that it can't be done. The problem is that Windows doesn't do it (although the appear to be moving in that direction). Neither do all Desktop Linux's I'm familiar with, nor does macos.

I think it's important to distinguish between the desktop and the kernel, because Android and ChromeOS are build with Linux and they enforce an access control system that is secure by default. I'm sure a secure OS could be built on the WinNT kernel too, but Microsoft only gives you one and it's insecure by default.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#103

Post by penguin_booze » Mon, Jul 22, 2024, 11:06 AM UTC

The saving grace is that this situation was salvageable by mortals.

Imagine the world where black box AI systems are deployed, and humanity gets too cozy and complicit with the amenities it offers--too lazy and too convenient to care. Then suddenly, a BSoD-equivalent happens. And nobody knows how to reason with it--or worse, through it; and nobody knows how write a 'hello world' nor to fire up a debugger any more.

Re: Microsoft's global sprawl under fire from regulators after Windows outage

#104

Post by ehsankia » Mon, Jul 22, 2024, 3:17 PM UTC

xboxnolifes wrote: post #64

ehsankia wrote: post #46

Earlier quoted context omitted.

I'm curious what people think, but while obviously CrowdStrike caused the breakage, does the Operating System not have some responsibility in not allowing such outages to happen? Especially if it's an enterprise product? Ideas: 1. Microsoft themselves could potentially enforce a gradual rollout on updates (did the update go through windows updates?) 2. Have better automatic recovery options, could windows have detect…

I'd expect the HN crowd to not give Microsoft beef here or want them to lock down the OS more. At least, that would be consistent with usual comments about letting users control their OS. Companies chose (with some regulatory pressure) to install CrowdStrike at the kernel level after all.

I didn't talk about locking down, but just generally building more resilience/recovery into the OS.

Also, from the little I saw, CrowdStrike got around certifying every driver update by pushing updates through "update" files that are read and executed by the driver. That seems like a huge hack to bypass certification and likely shouldn't be allowed?