Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CrowdStrike ex-employees: 'Quality control was not part of our process'

semafor.com

Post reply on HN
Print view View original

171–180 of 311 posts

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#171

Post by taspeotis »

qaq wrote: post #135
taspeotis wrote: post #52

Earlier quoted context omitted.

Personal: Nothing - Windows Defender is built into Windows. Business: Nothing - Windows Defender Advanced Threat Protection is built into the higher Microsoft 365 license tiers. It amazes me people chose to pay money to have all their PCs bluescreen.

large orgs want something that will run across all of their fleet so linux servers, Macs etc.

Linux: https://learn.microsoft.com/en-us/defender-endpoint/microsof...

macOS: https://learn.microsoft.com/en-us/defender-endpoint/microsof...

It does iOS and Android too.

Again, if you're an organisation big enough to care about single-pane-of-glass-monitoring you probably already have access to this via the Microsoft 365 license tier you're on.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#172

Post by tsimionescu »

hello_moto wrote: post #151
canucker2016 wrote: post #85

Earlier quoted context omitted.

They literally half-assed their deployment process - one part enterprisey, one part "move fast and break things". Guess which part took down much of the corporate world? from Preliminary Post Incident Review at https://www.crowdstrike.com/falcon-content-update-remediatio... : "CrowdStrike delivers security content configuration updates to our sensors in two ways: Sensor Content that is shipped with our sensor directl…

> one part enterprisey, one part "move fast and break things". When there's 0day, how enterprisey you would like to catch the 0day?

Not sure, but definitely more enterprisey than "release a patch to the entire world at once before running it on a single machine in-house".

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#173

Post by taspeotis »

Aeolun wrote: post #101
taspeotis wrote: post #52

Earlier quoted context omitted.

Personal: Nothing - Windows Defender is built into Windows. Business: Nothing - Windows Defender Advanced Threat Protection is built into the higher Microsoft 365 license tiers. It amazes me people chose to pay money to have all their PCs bluescreen.

mdatp is also a virus. So slow…

It can record some telemetry to help you understand why it's slow: https://learn.microsoft.com/en-us/defender-endpoint/troubles...

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#174

Post by abbadadda »

0xbadcafebee wrote: post #126
owl57 wrote: post #83

Earlier quoted context omitted.

Did you notice that the piece of software in question was apparently installed mostly in companies where regulations and inspections already override sysadmins' common sense? Are you sure the answer is simply more of the same?

I've worked in these enterprise organizations for a long time. They don't run on common sense, or even what one might consider "business sense". Their existing incentives create bizarre behavior. For example, you might think "if a big security exploit happens, the stock price might tank" . So if they value the stock price, they'll focus on security, right?. In reality what they do is focus on burying the evidence of…

Probably there should be an independent body that oversees postmortems on tech issues, with the ability to suggest changes. This is what airlines face during crash investigations and often new rules are put in place (e.g., don’t let the shift manager self-certify his own work in the incident where the pilot’s window popped off). How this would look like with software companies, and what the bar is for being subject to this rigor I don’t know (I suspect not for a Candy Crush outage though).

In general, the biggest problem I see with late stage capitalism, and a lack of accountability in general, is that given the right incentives people will “fuck things up” faster than you can stop them. For example, say CrowdStrike was skirting QA - what’s my incentive as an individual employee versus the incentive of an executive at the company? If the exec can’t tell the difference between good QA and bad QA, but can visually see the accounting numbers go up when QA is underfunded, he’s going to optimize for stock price. And as an IC there’s not much you can do unless you’re willing to fight the good fight day in and day out. But when management repeatedly communicates they do not reward that behavior, and indeed may not care at all about software quality over a 5 year time horizon, what do you do? The key lies in finding ways to convince executives or short of that holding them to account like you say.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#175

Post by superposeur »

jrm4 wrote: post #163

Does anyone have a logical reason why this company should not be sued into oblivion?

Yes, because in point of fact this company is the best at what it does — preventing security breaches. The outage — disruptive as it was — was not a breach. This elemental fact is lost amidst all the knee jerk HN hate, but goes a long way toward explaining why the stock only took a modest hit.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#176

Post by riedel »

pmlnr wrote: post #169
jgtrosh wrote: post #168

Earlier quoted context omitted.

Did somebody say GDPR?

Companies believe GDPR doesn't apply to their human resources.

They have IT policies to make sure it largely does not apply. Even in our policy officially any personal use is forbidden. Funnily there is also agreement with our employee board, that any personal use will not be sanctioned. So guess what happens. This done to circumvent not only GPR but also TTDSG in germany (which is harsher on 'spying' as it applies to telecoms. For any 'officially' gathered personal information though typical very specific agreements with our employee board exist though (reporting of illness, etc). Wonder how such information which is also sensitive in a workplace is handled. Also I see those systems used in hospitals etc, if other peoples data is pumped through this systems GDPR definitively applies and auditors may find it (I only know such auditing in finance though). In the future NIS2 will also apply so exactly the people that use such systems will be put under additional scrutiny. Hope this triggers also some auditing of the systems used and not just the use of more of such systems.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#177

Post by namaria »

llm_trw wrote: post #127
st3fan wrote: post #87

Earlier quoted context omitted.

It may depend a bit on your organization but I bet most folks using an EDR solution can tell you that Macs are probably very low on the list when it comes to malware. You can guess which OS you will spend time on every day ...

So because macs are not the targets of malware ... we're locking them down tighter than any other system?

No, see, they're leveling the playing field by storing all secrets they find on macs in plaintext

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#178

Post by zxexz »

skewer99 wrote: post #76
x3n0ph3n3 wrote: post #37

Earlier quoted context omitted.

Can you provide some more info on this? How do you know? Is this documented somewhere? I'm sure this is going to raise red-flags in my IT department.

AKIDs... ugh. They'll be there if you use AWS + Mac. Again, the plaintext is the problem. These environment variables get loaded from the command line, scripts, etc. - CrowdStrike and all of the best EDRs also collect and send home all of that, but probably in an encrypted stream?

I usually remote dev on an instance in a VPC because of crap like this. If you like terrible ideas (I don't use this except for debugging IAM stuff, occasionally), you can use the IMDS like you were an AWS instance by giving a local loopback device the link-local ipv4 address 169.254.169.254/32 and binding traffic on the instance's 169.254.169.254/32 port 80 to your lo's port 80, and a local AWS SDK will use the IAM instance profile of the instance you're connected to. I'll repeat, this is not a good idea.

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#179

Post by unilynx »

jgtrosh wrote: post #168
st3fan wrote: post #36

Found out that the CrowdStrike Mac agent (Falcon) sends all your secrets from environment variables to their cloud hosted SIEM. In plain text. Anyone with access to your CS SIEM can search for GitHub, aws, etc creds. Anything your devs, ops and sec teams use on their Macs. Only the Mac version does this. There is no way to disable this behaviour or a way to redact things. Another really odd design decision. They prob…

Did somebody say GDPR?

What would you expect the GDPR to say? This is allowed as long as the GDPRs requirements are followed

Re: CrowdStrike ex-employees: 'Quality control was not part of our process'

#180

Post by smolder »

jordanb wrote: post #108
vagrantJin wrote: post #91

Earlier quoted context omitted.

This is a true conspiracy .

Seriously? Crowdstrike is obviously NSA just like Kaspersky is obviously KGB and Wiz is obviously Mossad. Why else are counties so anxious about local businesses not using agents made by foreign actors?

KGB is not even a thing. Modern equivalent is FSB, no? I'm skeptical. I don't think it's obvious that these are all basically fronts, as much as I'm willing to believe that IC tentacles reach wide and deep.
Post reply on HN