Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CrowdStrike will be liable for damages in France, based on the OVH precedent

thehftguy.com

Post reply on HN
Print view View original

131–140 of 285 posts

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#131

Post by Retr0id »

vesinisa wrote: post #129
Retr0id wrote: post #110

I'm not a lawyer, and I'm definitely not a French lawyer, but I don't think the OVH comparison is valid. In the OVH case, their backup system (as a whole) failed. Many customers were left with 0 data, and per the article "the court ruled the OVH backup service was not operated to a reasonable standard and failed at its purpose". Meanwhile CrowdStrike "just" crashed their customer's kernels, for a duration of about 1…

> for a duration of about 1 hour Not even remotely correct. Most computers that were affected by the fault needed physical remediation via safe mode boot to fix the issue because they were not able to download a fix because of being stuck in a reboot loop. The understanding is that for most cases, the fix needed to be applied by an IT technician dispatched to physically access the computer. A week or 168 hours later,…

See the sentence I wrote just after that one.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#132

Post by 627467 »

itunpredictable wrote: post #89

This headline is kind of misleading. It's actually someone's personal (educated) opinion on a blog, not a statement of fact. Should be something more like "I think CrowdStrike will be liable" or "CrowdStrike should be liable"

the full headline (at this time at least) is more nuanced than seen here in hn: CrowdStrike will be liable for damages in France, based on the OVH precedent.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#133

Post by fabian2k »

Retr0id wrote: post #128
fabian2k wrote: post #124

Earlier quoted context omitted.

It didn't just crash, it crashed 100% of computers running it at that time and in a way that required physical intervention to fix. So I think you can considers this quite different from regular crashes because recovery is much more difficult and because it affected a lot of computers simultaneously. On top of that there are companies that had failures of their own in their recovery procedures. But even with good pro…

If the uptime of 100% of your computers depends on a single vendor not writing software with bugs in it, you have a problem.

That would mean that you always need a fully redundant copy of everything based on entirely different OSes and software with no common component. That is obviously not realistic.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#134

Post by davidmurdoch »

vladvasiliu wrote: post #79
justinclift wrote: post #52

Earlier quoted context omitted.

> Personally, I don't expect this to make much of a difference, if any. While you're probably right, I'm hoping ClownStrike's court results so absolutely dwarf their insurance coverage that it's nearly company ending. ie something to actually get them to improve things, not just generate empty PR platitudes: https://www.youtube.com/watch?v=SiL2AjOtjZI

Meh. We (techies) always knew the risks of running random crap in kernel space, especially when it runs junk it downloads from the internet. So, I expect this to be spun somehow along the lines of "sure all our boxes were down, but look, you've brought them all back up, didn't you? Now think about all the bad guys this protects us against! Of course the risk was worth it!". Also, "everybody does this! we couldn't hav…

I like to poke the security bears at my company by suggesting that the security team is actually a double agent team whose real employer is our competitor. They never find it funny for some reason.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#135

Post by 1970-01-01 »

GJim wrote: post #20
siva7 wrote: post #3

It's good to remind people that general liability waivers you often find with license agreements have no meaning outside of US jurisdiction if you're doing business in another jurisdiction.

The number of US tech businesses that are surprised they need, or think they can ignore the need, to obey employment and data protection laws when working in other jurisdictions is simply bonkers.

Yes however it goes both ways. TPB was excellent in telling the US lawyers to f-off: https://web.archive.org/web/20110623123349/http://thepirateb...

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#136

Post by jpambrun »

xxs wrote: post #33
GJim wrote: post #20

Earlier quoted context omitted.

The number of US tech businesses that are surprised they need, or think they can ignore the need, to obey employment and data protection laws when working in other jurisdictions is simply bonkers.

Well, it'd be a lot easier if most US entities understood that M/d/yy(yy) format is rare, or that default to Frankenstein degrees is pretty much the same/awkward (even Microsoft reset their weather widget to F on regular basis). The root of issue, not understanding local laws/culture, is very similar - surrounded by a vast market/culture (US +Canada) dulls your senses for the rest of the globe.

I am not sure it's fair to include Canada in the same basket. We don't use freedom degrees, we know that numbers should start with the most significant digits and I believe liability waivers have no value here as well.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#137

Post by noinsight »

dotancohen wrote: post #18

Can someone explain to me why the protections that Falcon provides, are not provided by the OS itself? I am not completely naive, I've secured quite a few critical Linux servers, but with Windows it seems that there do not exist the same clear roles of security. Contrast with Red Hat or even Canonical, where is feels like I'm (correctly) fighting the security of the systems to get them into a state where my users can…

Actually, arguably Windows has some impressive security features unseen on any other mainstream OS, they're just not used by default and - realistically - would be hard to enable on general purpose / non-corporate computers.

For example, by comparison, Linux is in the stone age here.

Do you even need AV if untrusted code can't run in the first place?

* Application whitelisting - with just bare old AppLocker, Windows can be configured to only allow execution of trusted executables, DLLs and scripts by path, hash or software vendor (digital signature). Now, technically AppLocker is not a security feature, i.e. a hard security boundary.

The next level functionality, Windows Defender Application Control (WDAC) [1], however, is. I believe Microsoft was offering up to a $1M bug bounty for WDAC bypasses?

With WDAC kernel mode code integrity enabled, only trusted digitally signed kernel modules can be loaded into the OS kernel [2]. WDAC user mode code integrity provides the aforementioned protection AppLocker provides.

With AppLocker / WDAC enabled, the OS built-in script interpreters (Windows Script Host, PowerShell) either refuse to execute unsigned scripts completely or operate in restricted mode with reduced functionality.

- By comparison, Linux only has fapolicyd which is only supported on Red Hat and can only rely on path-based rules because binaries are not directly signed on Linux. None? of the common interpreted languages (Python, Perl, Ruby, Bash) on Linux support digitally signed scripts and locking down interpretation.

* Authentication material protection - Windows has Credential Guard [3] for protection of authentication material - Kerberos tickets and other material are placed in a separate container protected by hardware virtualization [2] and accessed via RPC so you can't dump process memory to compromise them. Even kernel level compromise is not enough.

- By comparison, Kerberos tickets on Linux reside as files on disk, SSH user & host keys reside as files on disk and loaded into sshd/gpg-agent memory, x.509 keypairs reside as files on disk & process memory etc etc. Wouldn't it be nice to have them protected somehow? To my knowledge, nothing exists for this on Linux.

[1] WDAC - https://learn.microsoft.com/en-us/windows/security/applicati...

[2] VBS - https://learn.microsoft.com/en-us/windows-hardware/design/de...

[3] Credential Guard - https://learn.microsoft.com/en-us/windows/security/identity-...

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#138

Post by tuetuopay »

French here, and working for another french CSP. We lived the OVH incident live and saw the whole aftermath.

OVH was held liable because of the data loss, not for the service interruption. Data loss is something irremediable, permanent, definitive. Some businesses were basically ruined from this incident because they had no more data to operate. To add insult to injury, they sold offsite backups in the datacenter literally meters away. A service interruption, well, shit happens, and this is handled by SLA contracts that both parties agree to. You don't ruin a business (read: close a company) for a few days of outage.

I doubt CrowdStrike will be held liable for much; from corporations at least. They cannot repay the damage done, or they close the door. The healthcare sector is another beast, but I think it will come to more regulations for critical entities.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#140

Post by aoeusnth1 »

wkat4242 wrote: post #130
null_investor wrote: post #95

What is hilarious to me is how the US government or courts doesn't seem to give a shit about this. Corporativism in US is a thing. Companies can brick hospital systems killing patients, drive self-driving cars and run over people but don't get sued, and if they do, they settle for very little. Just look at the recent Boeing incident where people were killed, the company clearly misled the US authorities and settled o…

> Just look at the recent Boeing incident where people were killed, the company clearly misled the US authorities and settled only a $0.5B fine. The problem is when you fine a company, they will just turn around and offload that cost to their customers. Which in this case is the US government in a very large way. Boeing will make their part in the SLS a few billion more expensive again to offset it and even gain some…

You could force the company to pay the fine in the form of a % ownership stake in the company. Then if the company raises prices to hose the government, the extra profit flows back to the government in dividends.
Post reply on HN