Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CrowdStrike Update: Windows Bluescreen and Boot Loops

old.reddit.com

Post reply on HN
Print view View original

601–610 of 1001 posts

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#601

Post by __MatrixMan__ »

frankohn wrote: post #478

The Windows ecosystem typically deployed in corporate PCs or workstations is often insecure, slow, and poorly implemented, resulting in ongoing issues visible to everyone. Examples include problems with malware, ransomware, and Windows botnets. In corporate environments, IT staff struggle to contain these issues using antivirus software, firewalls, and proxies. These security measures often slow down PCs significantl…

The poor quality of Windows and associated software is not the problem here. The problem is that Microsoft especially, but software vendors generally, encourage users to blindly accept updates which they do not understand or know how to roll back. And by "encourage" I mean that they've removed the "no thanks" and "undo" buttons.

Here on Linux (NixOS), I am prompted at boot time:

> which system config should be used?

If I applied a bad update today, I can just select the config that worked yesterday while I fix it. This is not a power that software vendors want users to have, and thus the users are powerless to fix problems of this sort that the vendors introduce.

It's not faulty software, it's a problematic philosophy of responsibility. Faulty software is the wake-up call.

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#602

Post by guax »

steveBK123 wrote: post #537

Wild that a piece of software so integral to basic function has such bad release discipline. A/B, Blue/Green, Canary, Rolling, etc.. I've worked on 4 person software teams that at least followed basic user group rolling release system.

Integral? I would argue that is wild that a piece of software so useless for the basic and correct function gets so much privilege.

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#603

Post by smsm42 »

zmmmmm wrote: post #349

So CrowdStrike is deployed as third party software into the critical path of mission critical systems and then left to update itself. It's easy to blame CrowdStrike but that seems too easy on both the orgs that do this but also the upstream forces that compel them to do it. My org which does mission critical healthcare just deployed ZScaler on every computer which is now in the critical path of every computer startin…

Well, if you fail at compliance, you can be fired and sometimes even sued. If your compliance efforts cause system wide outage - nobody's to blame, shit happens. I predict this screwup will end up with zero consequences for anyone who took the decisions that led to it too. So how else do you expect this system to evolve, given this incentive structure?

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#604

Post by JackC »

JackC wrote: post #538

Crowdstrike did this to our production linux fleet back on April 19th, and I've been dying to rant about it. The short version was: we're a civic tech lab, so we have a bunch of different production websites made at different times on different infrastructure. We run Crowdstrike provided by our enterprise. Crowdstrike pushed an update on a Friday evening that was incompatible with up-to-date Debian stable. So we patc…

Oh, if you are also running Crowdstrike on linux, here are some things we identified that you _can_ do:

- Make sure you're running in user mode (eBPF) instead of kernel mode (kernel module), since it has less ability to crash the kernel. This became the default in the latest versions and they say it now offers equivalent protection.

- If your enterprise allows, you can have a test fleet running version n and the main fleet run n-1.

- Make sure you know in advance who to cc on a support ticket so Crowdstrike pays attention.

I know some of this sounds obvious, but it's easy to screw up organizationally when EDR software is used by centralized CISOs to try to manage distributed enterprise risk -- like, how do you detect intrusions early in a big organization with lots of people running servers for lots of reasons? There's real reasons Crowdstrike is appealing in that situation. But if you're the sysadmin getting "make sure to run this thing on your 10 boxes out of our 10,000" or whatever, then you're the one who cares about uptime and you need to advocate a bit.

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#605

Post by wcski »

runningmike wrote: post #358

Guess we will never read the real facts. Truth is RMS was right. Again. Closed source security software is too often malware by design. We need open solutions we can truly trust.

> Closed source security software is too often malware by design.

Can you be more specific? Genuinely curious what you mean here.

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#607

Post by bargle0 »

zmmmmm wrote: post #349

So CrowdStrike is deployed as third party software into the critical path of mission critical systems and then left to update itself. It's easy to blame CrowdStrike but that seems too easy on both the orgs that do this but also the upstream forces that compel them to do it. My org which does mission critical healthcare just deployed ZScaler on every computer which is now in the critical path of every computer startin…

CrowdStrike, ZScaler, and the rest of these people surely have lobbyists that ensure their software is compelled by regulators.

Re: CrowdStrike Update: Windows Bluescreen and Boot Loops

#608

Post by 23orj2o3 »

zmmmmm wrote: post #349

So CrowdStrike is deployed as third party software into the critical path of mission critical systems and then left to update itself. It's easy to blame CrowdStrike but that seems too easy on both the orgs that do this but also the upstream forces that compel them to do it. My org which does mission critical healthcare just deployed ZScaler on every computer which is now in the critical path of every computer startin…

When a metric becomes a target ...
Post reply on HN