Very carefully worded blog post title.
New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints
31–40 of 66 posts
Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints
#32Really impressive that they got thru an entire develop, build, approval, and documentation process in just about 2 days. Not that any of those steps are extremely hard for this fix, but I'm always impressed when big corporations can move so fast
They are not claiming they built it themselves. This kind of tool could easily be an offshore job.
Probably not doing that with this incident. But FBI/NSA is probably involved.
Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints
#33They should add CS Falcon to their malware definitions in Windows Defender. Crowdstrike has proved that its software is indistinguishable from malware. Also, while they're at it, add Trellex.
If you're running CrowdStrike I would think Windows Defender is probably disabled, no?
Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints
#34Did anyone write a script to remove the file directly from VM disks, rather than booting the OS? Or does crowdstrike somehow prevent that solution?
I imagine having an unencrypted disk in 2024 can be most charitably called 'an oversight', so there's little point in attempting to deal with them. (Remember we're talking about boxes with crowdstrike installed...)
Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints
#35Earlier quoted context omitted.
They made a special memory allocator for Windows 95 to avoid a crash caused by a bug in SimCity https://www.joelonsoftware.com/2000/05/24/strategy-letter-ii... They are not only backward compatible or bug compatible. They are others-person-bug compatible. It's the only way to prevent users thinking about switching to another OS.
Reminds me of this famous post from Linus about being "bug-compatible". https://lkml.org/lkml/2012/12/23/75
One thing I’ve never understood about “kernel never breaks user space”.. doesn’t that completely atrophy the kernel, preventing it from ever having big rewrites or architectural changes? What if an initial implantation was terrible, and there are 100x performance improvements to be had by doing a breaking change?
Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints
#36Earlier quoted context omitted.
Reminds me of this famous post from Linus about being "bug-compatible". https://lkml.org/lkml/2012/12/23/75
One thing I’ve never understood about “kernel never breaks user space”.. doesn’t that completely atrophy the kernel, preventing it from ever having big rewrites or architectural changes? What if an initial implantation was terrible, and there are 100x performance improvements to be had by doing a breaking change?
Implement a new API for the better route, isolate the terrible code as much as possible, notify the users, deprecate it, and remove it or move it to a userspace shim after enough years had past and almost everyone was off it?
Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints
#37People have been talking about how this is a CrowdStrike issue, and such on Reddit, etc. But in my opinion, it's appalling that Windows can allow this to happen.
Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints
#38Earlier quoted context omitted.
They could say "third party kernel modules are installed at your own risk" and provide the usual level of business hours support. CrowdStrike fucked up and Microsoft is helping its customers recover from CrowdStrike's fuckup.
They recommend crowdstrike to customers. Now they are trying to at least skim some good will. Also bad a kernel module that can ruin the OS is partially their fault.
Microsoft competes directly CrowdStrike with Defender across multiple areas - I'm not sure they recommend them to customer over their own products at the cost of losing sales.
I don't think Microsoft is realistically in a position to forbid other companies from writing kernel level modules, from an antitrust standpoint I would think that would land them under investigation(s)
Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints
#39[dead]
Re: New Recovery Tool to help with CrowdStrike issue impacting Windows endpoints
#40People have been talking about how this is a CrowdStrike issue, and such on Reddit, etc. But in my opinion, it's appalling that Windows can allow this to happen.
CrowdStrike installs as an operating system driver. It becomes essentially a part of the operating system and can do literally anything it wants, and Microsoft can not do much anything about it.
Going forward, I could foresee Microsoft requiring endpoint protection solution providers certify their QA processes to get signing. But staged rollouts and canary builds have already been an industry standard process long before CrowdStrike. There was no way Microsoft could have known that they were dealing with a company so incompetent as CrowdStrike to cause this to happen.