Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CrowdStrike will be liable for damages in France, based on the OVH precedent

thehftguy.com

Post reply on HN
Print view View original

241–250 of 285 posts

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#241

Post by HappySweeney »

627467 wrote: post #207
dathinab wrote: post #159

Earlier quoted context omitted.

IMHO it would send really wrong signals if this doesn't end up with CrowdStrike closing their doors... like if the largest outage in history was caused by you due to a config parser failing and it looks as far as I can tell that they didn't follow industry best practices when it comes to config/parsing handling and probably also didn't follow some best practices when it comes to kernel module programming then honestl…

I understand that CS doesn't draw much sympathies even before this happened - from myself included - and it is easy to pin point systemic issues to a single failure point and make it liable and financially responsible for all downstream failures. But this only creates excuses for all other responsible players in this systemic issue - or society at large. Just to pick 1 example: I keep reading comments on how profound…

I read that healthcare was mollified by a facility whereby they could choose when and which updates to allow, which CS intentionally bypassed with this latest update. This was during the chaotic day-of though, so possibly false.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#242

Post by cesarb »

dathinab wrote: post #230
gruez wrote: post #219

Earlier quoted context omitted.

What are they supposed to use instead? "Starting in Q3/H2"?

yes, many non US firms do exactly that for international announcements: - use "second half of ", "begin of", 3 quartal of, etc. - or a specific month if they want to be more precise also for western focused announcements they also use "holliday session" as their tends to be a holliday session in most countries in both summer and winter (through their start differs _a lot_, but it tends to just work out if you release…

> use "second half of ", "begin of", 3 quartal of, etc.

And they sometimes use their internal fiscal year, which doesn't align with the calendar year. So sometimes, when they speak of the "fourth quarter" of an year they are talking about the beginning of the next year, or in the opposite direction, they might speak of the "first quarter" of an year but they're talking about the end of the preceding year.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#243

Post by gruez »

ralgozino wrote: post #223
gruez wrote: post #219

Earlier quoted context omitted.

What are they supposed to use instead? "Starting in Q3/H2"?

Maybe you are not aware but while it is summer in the northern hemisphere in the southern hemisphere you have winter (and so on). So, speaking of seasons means exactly the opposite depending on which hemisphere you are. What's wrong with using a calendar date like may the 1st? I know that there are other calendars too. But is more manageable IMO.

>What's wrong with using a calendar date like may the 1st?

Usually it's because they want to keep it vague because the exact date (or even month) hasn't been set yet.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#244

Post by gruez »

dathinab wrote: post #230
gruez wrote: post #219

Earlier quoted context omitted.

What are they supposed to use instead? "Starting in Q3/H2"?

yes, many non US firms do exactly that for international announcements: - use "second half of ", "begin of", 3 quartal of, etc. - or a specific month if they want to be more precise also for western focused announcements they also use "holliday session" as their tends to be a holliday session in most countries in both summer and winter (through their start differs _a lot_, but it tends to just work out if you release…

The meteorological dates for "summer" correspond to June 1 to August 31. That straddles 2 quarters and both halves of the year. What are you going to do if a product launch is in July (+- 1 month)? You can't really use Q3 or H2 because neither of them fully captures that 3 month period.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#245

Post by cesarb »

simiones wrote: post #183
fulafel wrote: post #166

Earlier quoted context omitted.

There are 2 possible questions. (1) - Why is a crutch like "anti-virus" software needed? Essentially trying to reactively cat-and-mouse hostile software that the OS has let execute on the computer. (2) Why doesn't Windows provide AV? Question (1) is more interesting - and (2) is addressed by other comments. I think both MS and their customers have very seldom prioritized security over even small compromises in functi…

The cat-and-mouse game is between OS security features and hackers. AV software is not a crutch, it's an extra level of defense. All OS kernels are vulnerable to malware - this is a 100% given at this moment in history. The question is how to mitigate this problem, and AV is one component of that, as are firewalls, network-level intrusion prevention systems, and a whole host of other security software. Maybe some day…

> AV software is not a crutch, it's an extra level of defense.

The issue is that it's the only "level of defense" which introduces arbitrary non-deterministic behavior. An executable which correctly follows all the APIs as documented and implemented, and which does nothing malicious, might arbitrarily be denied or even erased, and this behavior changes daily or even hourly due to factors outside the control of the computer's user. Even ASLR, which uses non-determinism in its implementation, doesn't cause non-deterministic behavior when an executable correctly follows the API.

And it's also a "level of defense" which famously causes frequent performance issues, to the point that "tell the AV to ignore that folder" is a common recommendation. I wonder how many gigawatts of electricity are wasted daily due to AV software slowing things down.

Finally, it's been reported several times that this "level of defense" is often poorly implemented, to the point that it can act as a backdoor to bypass other levels of defense. If you can compromise a parser running as SYSTEM, or even within the kernel, you don't have to worry about all the normal rules which prevents you from running code as SYSTEM or within the kernel.

People's dislike of AV software does not come only from some abstract purity ideal; it also come from plenty of negative experiences with it.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#246

Post by ykonstant »

sofixa wrote: post #225
ykonstant wrote: post #197

Earlier quoted context omitted.

>- By comparison, Kerberos tickets on Linux reside as files on disk, SSH user & host keys reside as files on disk and loaded into sshd/gpg-agent memory, x.509 keypairs reside as files on disk & process memory etc etc. Wouldn't it be nice to have them protected somehow? To my knowledge, nothing exists for this on Linux. I have always wondered about that; there has to be a more secure control method for those secrets.

There is, the TPM. SSH keys can easily be stored and used from there.

I can do that as a user? With what utility?

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#247

Post by dotancohen »

tyingq wrote: post #224
jpambrun wrote: post #192

Earlier quoted context omitted.

I read that a lot, but nobody ever provide supporting evidence. To me, this sounds a bit like 3rd party security marketing being really effective.

There are actual differences, and eval frameworks to get the details you're asking for. A screenshot of one comparison from Mitre: https://imgur.com/a/WH0reRy You can do more of them here: https://attackevals.mitre-engenuity.org/ It's not a huge difference, but there's a difference. Also, I have no relationships or investments, etc. Not shilling. Edit: Also, that url slug from imgur. Heh.

I wouldn't have noticed the slug if you hadn't mentioned it. Made my day, very appropriate ))

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#248

Post by TillE »

wkat4242 wrote: post #141
Patient0 wrote: post #36

Earlier quoted context omitted.

I read an article that stated that Microsoft lost an anti-trust court case against the EU in which the EU mandated that they allow third party competitors to provide this service. Microsoft has its own solution called Windows Defender. https://www.theregister.com/2024/07/22/windows_crowdstrike_k...

It's more nuanced than that. They have to provide the same APIs to third party security vendors that they use themselves. They can come up with something more shielded as Apple has done, they just have to eat their own dog food and can't make an exception for defender. That's all. Blaming the EU here is pure spin.

And Microsoft doesn't even offer the option of userspace anti-malware hooks, which they could easily do in conjunction with the kernel stuff. I think all they have is AMSI, which is only for scanning PowerShell scripts and such.

If you want to hook process execution or file access, you're writing a kernel driver.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#249

Post by wkat4242 »

TillE wrote: post #248
wkat4242 wrote: post #141

Earlier quoted context omitted.

It's more nuanced than that. They have to provide the same APIs to third party security vendors that they use themselves. They can come up with something more shielded as Apple has done, they just have to eat their own dog food and can't make an exception for defender. That's all. Blaming the EU here is pure spin.

And Microsoft doesn't even offer the option of userspace anti-malware hooks, which they could easily do in conjunction with the kernel stuff. I think all they have is AMSI, which is only for scanning PowerShell scripts and such. If you want to hook process execution or file access, you're writing a kernel driver.

Yes indeed. But the point they keep making is that the agreement with the EU somehow stopped them from doing this. Which is BS.

They could easily have added a userspace API if they wanted to. It could have existed side by side with the kernel option, as long as they keep using that for Defender too. Only once they stop using kernel access in their own security products can they force the other vendors to use a new API, which makes sense. Otherwise they'd use it as a sales bullet point ("Our product has full system access, others don't"). Which would destroy the antimalware market. The US benefits from this too.

Re: CrowdStrike will be liable for damages in France, based on the OVH precedent

#250

Post by wkat4242 »

simiones wrote: post #209
wkat4242 wrote: post #181

Earlier quoted context omitted.

They can in the short term because they have tons of companies way too invested in their ecosystem to change. See what VMWare did after the broadcom takeover. They did exactly that.

Then what's stopping them from charging more today, in the absence of any fine?

Probably that they care about their customers, unlike Broadcom who just wants to milk the fat whales and isn't interested in the small fry. In other words: long-term vision over short-term gains.
Post reply on HN