We need laws and regulations on software the same way we have for toys, cars, airplanes, boats, buildings.
This silicon valley libertarian non sense needs to stop.
CrowdStrike ex-employees: 'Quality control was not part of our process'
161–170 of 311 posts
Re: CrowdStrike ex-employees: 'Quality control was not part of our process'
#162[dead]
Re: CrowdStrike ex-employees: 'Quality control was not part of our process'
#163Does anyone have a logical reason why this company should not be sued into oblivion?
Re: CrowdStrike ex-employees: 'Quality control was not part of our process'
#164Earlier quoted context omitted.
Exporting to a SIEM does not correlate to either of those extremes. It’s stupidity and makes auditing worse
SIEM = Security Information & Event Management Factually, it is necessary for auditing and absolutely correlates with the extreme of needing to monitor the “usage” of “secrets”. In a highly auditable/“secure” environment, you can’t give secrets to employees with no tracking of when the secrets are used.
A secure environment doesn't involve software exfiltrating secrets to a 3rd party. It shouldn't even centralize secrets in plaintext. The thing to collect and monitor is behavior: so-and-so logged into a dashboard using credentials user+passhash and spun up a server which connected to X Y and Z over ports whatever... And those monitored barriers should be integral to an architecture, such that every behavior in need of auditing is provably recorded.
If you lean in the direction of keylogging all your employees, that's not only lazy but ineffective on account of the unnecessary noise collected, and it's counterproductive in that it creates a juicy central target that you can hardly trust anyone with. Good auditing is minimally useful to an adversary, IMO.
Re: CrowdStrike ex-employees: 'Quality control was not part of our process'
#165Not justifying what they did with qc, but qc is missing from quite a few places in software development that I've been apart of. People might get the impression from the article that every software project is well tested, whereas in my experience most are rushed out.
Exactly.
Much of the discourse around this topic has described ideal testing and deployment practise. Maybe it's different in Silicon Valley or investment banks, but for the sorts of companies I work for (telco mostly) things are very far from that ideal.
My view of he industry is one of shocking technical ineptitude from all but a minority of very competent people who actually keep things running... Of management who prioritize short term cost reduction over quality at every opportunity, leading to appalling technical debt and demoralized, over-worked staff who rapidly stop giving a damn about quality, because speaking out about quality problems is penalized.
Re: CrowdStrike ex-employees: 'Quality control was not part of our process'
#166Earlier quoted context omitted.
This kind of information seems like it should have a CVE and a responsible disclosure process. Kidding, mostly, but wow that's a hell of a vulnerability.
It is not a vulnerability, you literally pay for this feature. I really don't want to defend Crowdstrike but HN keeps making it hard not to.
Storing secrets in unsecured environments in plaintext is literally a vulnerability.
One of the most famous examples can be seen in the NSA slide at the top of this article:
https://www.washingtonpost.com/world/national-security/nsa-i...
Re: CrowdStrike ex-employees: 'Quality control was not part of our process'
#167Earlier quoted context omitted.
It is not a vulnerability, you literally pay for this feature. I really don't want to defend Crowdstrike but HN keeps making it hard not to.
Storing secrets in unsecured environments in plaintext is literally a vulnerability. One of the most famous examples can be seen in the NSA slide at the top of this article: https://www.washingtonpost.com/world/national-security/nsa-i...
the security tools' storage system is always considered a secured environment.
Re: CrowdStrike ex-employees: 'Quality control was not part of our process'
#168Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs. Only the Mac version does this. There is no way to disable this behaviour or a way to redact things. Another really odd design decision. They prob…
Did somebody say GDPR?
Re: CrowdStrike ex-employees: 'Quality control was not part of our process'
#169Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs. Only the Mac version does this. There is no way to disable this behaviour or a way to redact things. Another really odd design decision. They prob…
Did somebody say GDPR?
Companies believe GDPR doesn't apply to their human resources.
Re: CrowdStrike ex-employees: 'Quality control was not part of our process'
#170Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs. Only the Mac version does this. There is no way to disable this behaviour or a way to redact things. Another really odd design decision. They prob…
that's what EDRs do. anyone with access to your SIEM or CS data should also be trusted with response access (i.e.: remotely access those machines). If you want this redacted, it is a SIEM functionality not Crowdstrike's. Depends on the SIEM but even older generation SIEMs have a data scrubbing feature. This isn't a Crowdstrike design decision as you've put it. any endpoint monitoring too, including the free and open…
Don't downvote this, this is the sad truth.