171–180 of 285 posts
That would have been literally the headline I'd choose for the bug.
This is incompetence that in a just world would result in the corporate death penalty.
I'm not a lawyer, and I'm definitely not a French lawyer, but I don't think the OVH comparison is valid. In the OVH case, their backup system (as a whole) failed. Many customers were left with 0 data, and per the article "the court ruled the OVH backup service was not operated to a reasonable standard and failed at its purpose". Meanwhile CrowdStrike "just" crashed their customer's kernels, for a duration of about 1…
Earlier quoted context omitted.
Well, it'd be a lot easier if most US entities understood that M/d/yy(yy) format is rare, or that default to Frankenstein degrees is pretty much the same/awkward (even Microsoft reset their weather widget to F on regular basis). The root of issue, not understanding local laws/culture, is very similar - surrounded by a vast market/culture (US +Canada) dulls your senses for the rest of the globe.
I am not sure it's fair to include Canada in the same basket. We don't use freedom degrees, we know that numbers should start with the most significant digits and I believe liability waivers have no value here as well.
Am curious: where does that not happen in the US?
(And in parts of Canada they say 4-20-10 to mean 90 :-)
Earlier quoted context omitted.
> surrounded by a vast market/culture (US +Canada) US companies don't think about Canada as anything but an afterthought, and struggle with the same issues here that you just mentioned. Canada is metric, uses different spellings (closer to UK English.. colour, not color [Chrome just marked my spelling as wrong despite me having Canadian English as my setting]) and is officially bilingual with localization laws requir…
> And navigation on Android / Google Maps can't pronounce French names for streets/places while driving around in bilingual places in Canada. Honestly, I think this is the right approach, and I'm speaking as a bilingual French/English speaker. Google Maps doesn't know that you are bilingual. So it has two choices: pronounce words the "right" (i.e., native) way, or pronounce them the "English" way. If someone who is u…
Even, like, names ... Duplessis or Cartier or whatever... just completely unrecognizable.
Or take the way it reads out the exits off the 401 in Toronto, reading the full bilingual sign (where there is one) with the English first and then the French part as if it was a continuation ... in English ("Sud" read out like you'd say that if it was an English word, hard D and everything.) Clearly, they should just drop the French part, but their system can't comprehend that a sign could be bilingual. Because America.
Look, I don't speak French, I'm not bilingual, and it drives me nuts when I'm in QC or even just Ottawa etc. I literally can't tell what street it's talking about, it doesn't correspond with the sign. It's incoherent.
What's mind boggling is that Google navigation is completely fine reading out Spanish words when I drive around California. C'mon.
Earlier quoted context omitted.
> we use metric system and his response was “but don’t you learn *the standard* system in ache school?” I did not know, how to respond It’s just a difference in travel and seniority. If you aren’t talking across continents there is no need to speak two languages.
> If you aren’t talking across continents there is no need to speak two languages Continents have nothing to do with this. If you live in the UK and need to talk to people in the USA and Australia, you can be monolingual and still speak with people in three continents. If you live in Switzerland, you may need to speak 3 languages just to be able to talk with all your neighbors.
My going to a conference in India and arguing over the lakh/crore system isn’t useful to anyone [1].
Earlier quoted context omitted.
See the sentence I wrote just after that one.
How is it someone other than CrowdStrike's fault that the systems failed again at every reboot until someone with physical access and know-how deleted the crashing driver manually from recovery mode? What should a company operating, say, an MRI machine protected by CrowdStrike have done to recover access in a reasonable amount of time?
"Neither the offerings nor crowdstrike tools are for use in the operation of [...] direct or indirect life-support systems [...] or any application or installation where failure could result in death, severe physical injury, or property damage."
Earlier quoted context omitted.
Windows does have Defender, which does some amount of tracking signatures and heuristics of various types of malware. It has not, however, proved enough to fend off different real world problems like ransomware. Hence, the market for 3rd party solutions that are more aggressive. And to keep up with real world threats, they have to update often. And have to run at high privilege levels. So now you have the situation w…
Microsoft has a high share in this area but enterprise security is generally a very competivite market. Microsoft may even move into #1 position as a fallout from this debacle becasue the market share between them and the #1 CS is very small (that does not mean people actually buy more Ms btw... if that needs to be said ;) This is not neccesarily a good thing for MSFT as it will 100% trigger regulator rage in the EU.…
https://www.microsoft.com/en-us/security/blog/wp-content/upl...
Earlier quoted context omitted.
> How do you actively detect a malware agent running in user space using stealth or a kernel. You start with correct design. The system has a root of trust (ideally you skip the insane level of complexity that is Secure Boot + TPM and use something simple, testable, and verifiable — this isn’t actually that hard). Only authorized images will boot, and, more importantly, nothing else on the network trusts the machine…
What you've answered is a great (if not the best) way to defend against attackers, but not what was asked,They asked how to detect. I'll strongly disagree on selinux, I have seen it work in practice to defeat attackers many times, that provide features that seccomp and cgroups etc do not.
If your system is a flight information display, then you may well have two userspace processes that do anything of significance: the display manager and the actual app. There is no persistent state. At this point, SELinux is purely overhead and extra attack surface — what would it even protect.
If your payload is a container (database server, microservice, whatever), and you’re doing some form of best-practice volume management, then only the database’s own data is mounted for it. SELinux is a real PITA to get working in a context like this, and it’s not really clear what it would add. (Okay, maybe you get fancy and use it to restrict what can talk to the microservice. Or maybe you use network namespaces.)
If you’re running a desktop or a more conventional server setup, then, sure, MAC policy has its place.
Can someone explain to me why the protections that Falcon provides, are not provided by the OS itself? I am not completely naive, I've secured quite a few critical Linux servers, but with Windows it seems that there do not exist the same clear roles of security. Contrast with Red Hat or even Canonical, where is feels like I'm (correctly) fighting the security of the systems to get them into a state where my users can…
Finally, even when the OS does natively provide services like these (Enterprise versions of Windows do provide all the features I mentioned above), it's perfectly reasonable to prefer a different vendor for those solutions. Maybe people trust CrowdStrike's malware signature lists more than they do Microsoft's, for example: a good reason to buy CrowdStrike instead of using Windows Defender.
I'm not trying to defend CrowdStrike or Windows here. But I think it's obvious that there are many features that fall under the umbrella of security that you wouldn't want to build into the OS itself, and even when a version of them exists built-in, that a company may wish to source from a different vendor.
Can someone explain to me why the protections that Falcon provides, are not provided by the OS itself? I am not completely naive, I've secured quite a few critical Linux servers, but with Windows it seems that there do not exist the same clear roles of security. Contrast with Red Hat or even Canonical, where is feels like I'm (correctly) fighting the security of the systems to get them into a state where my users can…
How do you actively detect a malware agent running in user space using stealth or a kernel. Authors of such are fully aware of Linux hardening like SELinux / AppArmor and work around it.
